notes-organize
Pass
Audited by Gen Agent Trust Hub on Jul 24, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the Bash tool to execute a local script located at $HOME/.claude/plugins/marketplaces/cc-skills/plugins/notes-commander/scripts/notes.ts using the bun runtime. This is the intended execution model for this utility.
- [PROMPT_INJECTION]: The skill processes user-controlled data (note titles and folder names), which constitutes a surface for indirect prompt injection.
- Ingestion points: Note titles, folder names, and account names are retrieved from the macOS Notes application and processed by the agent to determine organization logic.
- Boundary markers: The instructions do not specify any explicit boundary markers or delimiters for note metadata, though they advise using unique IDs to resolve ambiguity.
- Capability inventory: The skill possesses the capability to execute shell commands (via bun) and interact with the macOS Notes database via AppleScript.
- Sanitization: The markdown documentation does not explicitly detail sanitization procedures for special characters in titles, though the underlying TypeScript logic in notes.ts is intended to handle these primitives.
Audit Metadata