The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The setup process requires cloning a repository from a personal GitHub account (github.com/connerkward/mcp-apple-notes) and installing third-party dependencies using the bun package manager.
[COMMAND_EXECUTION]: Instructions guide the user to execute several shell commands, including software installation (brew install oven-sh/bun/bun), dependency installation (bun install), and system-level configuration for the MCP server.
[PRIVILEGE_ESCALATION]: The skill requires the user to grant 'Full Disk Access' to the bun binary via macOS System Settings. While functionally necessary to read the Apple Notes database file (NoteStore.sqlite), this permission provides the runtime with access to nearly all protected user data on the machine, including Mail, Messages, and Safari history.
[DATA_EXPOSURE]: The server directly accesses and processes the user's private Apple Notes database. While the skill claims processing is primarily on-device, synthesis of answers involves sending note content to an LLM (either local or cloud-based via OpenAI), which could lead to sensitive data exposure depending on the user's configuration.
[INDIRECT_PROMPT_INJECTION]:
Ingestion points: The skill ingest untrusted data in the form of existing Apple Notes during search and synthesis tasks (e.g., search-notes, get-note).
Boundary markers: No explicit delimiters or instructions are provided to the agent to treat note content as data rather than instructions.
Capability inventory: The skill provides tools for both reading (get-note) and writing (create-note, update-note) to the database.
Sanitization: There is no evidence of sanitization or filtering of note content before it is interpolated into the agent's context for synthesis.

apple-notes-search