The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it reads and processes user-controlled data from Apple Reminders (titles, notes, and URLs) which could contain malicious instructions intended to influence the agent.
Ingestion points: Untrusted data enters the agent's context through the output of commands such as remindctl show, remindctl search, and remindctl info (found in SKILL.md).
Capability inventory: The agent has the capability to modify, delete, and create reminders, as well as trigger geocoding and open URLs (found in Sources/remindctl/Commands/).
Boundary markers: The skill does not implement specific delimiters or instructions to the agent to disregard instructions found within reminder content.
Sanitization: There is no evidence of sanitization or filtering applied to the reminder data before it is presented to the agent.
[COMMAND_EXECUTION]: The skill's diagnostic command executes a local system binary to read metadata from the Reminders database.
Evidence: Sources/remindctl/RichReadDiagnostics.swift uses Process() to invoke /usr/bin/sqlite3 for reading table counts from the local Reminders database located in the user's library directory.
[EXTERNAL_DOWNLOADS]: The project fetches a third-party dependency from a public repository during the build process.
Evidence: Package.swift and Package.resolved include the Commander library from https://github.com/steipete/Commander.git.

apple-reminders