lov-finder-action

SUSPICIOUS: the overall purpose is coherent for a macOS Finder-action generator, and the main dependency source is legitimate, but the skill normalizes broad local execution patterns: arbitrary shell-command generation, a clipboard-driven Helper App that executes pasted commands, wide filesystem scope, and direct installation into /Applications. This is not confirmed malware or credential theft, but it carries meaningful local-execution and permission risk beyond a narrow menu-generator guide.

This code is designed to open Terminal/iTerm and execute a `cd` to a provided directory by generating and executing AppleScript. While the intended behavior is benign and no clear exfiltration or persistence is present, it uses a high-sensitivity execution primitive (`NSAppleScript.executeAndReturnError`) with only partial escaping of untrusted input. If `path` can be attacker-influenced, it presents a plausible AppleScript/shell command injection risk in the user’s Terminal/iTerm session. Strong input validation/allowlisting or safer APIs (avoiding AppleScript command injection) are recommended.

This is build/entitlements configuration rather than executable code and shows no direct evidence of malware behavior (no network/exfiltration logic, no secrets, no command execution in the snippet). The standout risk is the FinderExtension’s entitlement granting broad read/write access to the entire filesystem (root '/') and enabling Apple Events automation; these permissions significantly increase the blast radius of any malicious or compromised extension logic. Validate that the FinderSync implementation strictly justifies these entitlements and that embedded frameworks/artifacts are integrity-protected, especially given customized LD runpath search paths and manual signing settings.