The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses the osascript tool to interact with the macOS system and applications.
Evidence: The script executes osascript -l JavaScript to query the Apple Notes application for accounts, folders, and note content.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the user's Apple Notes, which could theoretically contain malicious instructions targeting the AI agent.
Ingestion points: Note bodies are read via n.body() in the backup script within SKILL.md.
Boundary markers: No boundary markers or instructions to ignore embedded content are used when capturing note data.
Capability inventory: The skill has access to Bash, Write, Edit, and Read tools.
Sanitization: There is no evidence of sanitization or escaping of the note content before it is processed or written to disk.
[DATA_EXFILTRATION]: The skill accesses sensitive user information as part of its migration and backup functionality.
Evidence: The script in SKILL.md iterates through all Apple Notes accounts and notes, capturing the id, name, body, and metadata, writing this sensitive data to a local file at $HOME/notes-pre-upgrade-.../full-backup.json. While the operation is local, it involves the exposure of full note contents.

apple-notes-upgrade-migration