The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructions involve cloning a community-provided repository (https://github.com/connerkward/mcp-apple-notes) and installing its dependencies using 'bun install'. These resources are sourced from a community account and are not verified.
[PRIVILEGE_ESCALATION]: The setup process instructs the user to manually grant 'Full Disk Access' to the 'bun' binary on macOS. This permission allows the software to bypass system protections and read sensitive user data across the entire disk, including messages, emails, and backups, which exceeds the scope required for searching Apple Notes.
[DATA_EXFILTRATION]: The skill includes a 'synthesis' feature that transmits note contents to external cloud providers (such as OpenAI) if configured by the user. While documented, this creates a channel for sensitive personal notes to be sent to remote servers.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the user's Apple Notes, creating a surface for indirect prompt injection. Malicious instructions stored within notes could potentially influence the agent's behavior during search or synthesis operations.
Ingestion points: Tools such as 'search-notes', 'get-note', and 'related-notes' read content directly from the local Apple Notes SQLite database.
Boundary markers: The instructions lack specific delimiters or directions to ignore embedded instructions within processed notes.
Capability inventory: The skill has capabilities to modify the local file system (creating/updating notes) and access the network via the synthesis functionality.
Sanitization: No evidence of input sanitization or instruction filtering is provided for the data read from notes.

apple-notes-search