apple-notes
Warn
Audited by Gen Agent Trust Hub on Oct 3, 2026
Risk Level: MEDIUMDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DYNAMIC_EXECUTION]: The skill uses AppleScript to interact with the macOS Notes application. Instructions in
references/scripting.mddescribe deriving operation-specific scripts from the application's scripting dictionary (Notes.sdef) at runtime. While the skill mandates passing dynamic inputs through arguments rather than interpolation to mitigate injection risks, the process of assembling and executing script code at runtime constitutes dynamic execution. - [INDIRECT_PROMPT_INJECTION]: The skill represents a surface for indirect prompt injection because it reads and processes existing note content which may be sourced from shared notes or external inputs.
- Ingestion points: Note bodies and plaintext are read during discovery, preservation, and verification steps (e.g.,
SKILL.mdStep 4 andreferences/scripting.md). - Boundary markers: The instructions do not define specific delimiters to separate untrusted note content from agent instructions, though they recommend HTML-escaping content during creation.
- Capability inventory: The skill can execute AppleScript, perform GUI automation ("native computer use"), and read/write local files.
- Sanitization: The skill advises HTML-escaping for content creation, but lacks explicit sanitization or filtering for content ingested from notes before it is processed by the agent.
Audit Metadata