apple-apps
Pass
Audited by Gen Agent Trust Hub on Oct 2, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructions involve the use of host-level automation and interaction tools.
- Evidence:
SKILL.mdandreferences/project-contract.mdreference the use of "native app scripting", "computer-use tool", and "Peekaboo local execution" to interact with the macOS environment and user interface. - [INDIRECT_PROMPT_INJECTION]: The skill has an attack surface for indirect prompt injection due to its core function of processing data from external macOS applications.
- Ingestion points:
SKILL.md(reading content from Apple Notes and Reminders) andreferences/project-contract.md(GUI inspection of visible prompts and window labels). - Boundary markers: While the skill does not define specific string delimiters for ingested data, it includes a security-positive instruction to "Keep payloads and full item bodies local."
- Capability inventory: Access to native app scripting dictionaries and a computer-use tool capable of simulating user input (mouse/keyboard).
- Sanitization: No specific input sanitization or filtering logic is described for the content retrieved from applications.
Audit Metadata