The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts/fetch-notes.sh script is vulnerable to AppleScript injection. It directly interpolates shell variables ($ARG, $NOTE_NAME) into AppleScript command strings executed via osascript. Because these variables are not sanitized for double quotes or AppleScript syntax, a malicious value could escape the string literal and execute arbitrary AppleScript commands, including do shell script to run shell commands on the host system.
[DYNAMIC_EXECUTION]: The scripts/fetch-notes.sh utility dynamically generates executable AppleScript code at runtime. The script uses string concatenation to build queries for the macOS Notes application, which is a fragile pattern that facilitates the command injection vulnerability mentioned above.
[INDIRECT_PROMPT_INJECTION]: The skill ingests data from potentially untrusted sources (macOS Notes and local markdown files) and processes it to generate content.
Ingestion points: Reads content from X_SOURCE_FILE (markdown file) and the output of scripts/fetch-notes.sh (macOS Notes content).
Boundary markers: The SKILL.md instructions lack explicit boundary markers or 'ignore embedded instructions' directives when reading source material.
Capability inventory: The skill has the ability to execute shell scripts (scripts/fetch-notes.sh) and write/append to local files (X_DRAFTS_FILE).
Sanitization: There is no evidence of sanitization or content filtering for the data retrieved from notes before it is analyzed by the agent.

x-writing