draft-hold
Pass
Audited by Gen Agent Trust Hub on Aug 11, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a local Bash shim to invoke a TypeScript engine via Bun. It uses AppleScript to perform CRUD operations in macOS Notes and to create view-only mirrors in the Stickies application.
- [DATA_EXFILTRATION]: The skill retrieves text content from macOS Notes and accesses Claude session metadata from the local filesystem. This data is used to maintain draft history and provenance within the agent's context.
- [PROMPT_INJECTION]: The skill processes content from macOS Notes that may have been edited by the user or other external factors, creating an indirect prompt injection surface.
- Ingestion points: Data is ingested via the
getcommand which reads the body of macOS Notes. - Boundary markers: A provenance footer (
------) is used to delimit draft content, although explicit prompt instructions to ignore embedded commands are not included. - Capability inventory: The skill is scoped to use
BashandReadtools. - Sanitization: The engine performs HTML entity decoding to ensure data integrity during round-trips but does not perform safety-based content filtering.
Audit Metadata