card-widget
Pass
Audited by Gen Agent Trust Hub on Jul 16, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/fetch_todo_reminders.pyexecutesosascriptto interface with the macOS Reminders application. This is a legitimate functional requirement to display the user's tasks on the e-ink screen. The script includes anescapefunction to mitigate potential injection within the AppleScript execution. - [COMMAND_EXECUTION]: The
scripts/install_firmware.pyscript usesesptool.pyvia a subprocess call to flash firmware to the M5Paper device. This is a standard operation for managing ESP32-based hardware. - [EXTERNAL_DOWNLOADS]: The
scripts/install_firmware.pyscript provides a mechanism to download firmware binaries from a user-supplied URL. It implements a security check requiring a SHA256 hash, which is verified against the downloaded file before any flashing operations occur to ensure file integrity. - [DATA_EXPOSURE]: The skill accesses local system data such as macOS Reminders and system resource metrics (CPU, Memory). This data is communicated solely to a local daemon running on
127.0.0.1:9877for rendering on the connected e-ink display, representing a local-only data flow.
Audit Metadata