Apple Contacts

• Outcome: Review
• Latest audit: Sep 11, 2026 · 4:35 AM UTC
• Version: 1.0.0

Overview

This skill is a legitimate macOS Contacts manager, but it needs review because it can expose and persistently change sensitive contact data with weak safeguards.

Install only if you are comfortable granting the agent host access to your macOS Contacts. Before using write actions, manually confirm the exact contact, prefer stable IDs where available, avoid ambiguous names, and be cautious running the bundled tests because they modify the real Contacts database.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/mac-contacts.py:570
• Finding: AppleScript Injection Through Contact and Group Names<![CDATA[ ## Vulnerability Details **File Location**: `scripts/mac-contacts.py:570-582` **Vulnerability Type**: AppleScript injection caused by unsafe source-code construction **Risk Level**: High ### Vulnerable Code ```python safe_name = args.name.replace('"', '\\"') safe_list = args.list.replace('"', '\\"') script = ( f'tell application "Contacts"\n' f' set theGroup to group "{safe_list}"\n' f' set thePeople to (every person in theGroup whose name is "{safe_name}")\n' f' repeat with p in thePeople\n' f' remove p from theGroup\n' f' end repeat\n' f' save\n' f'end tell' ) result = subprocess.run(['osascript', '-e', script], capture_output=True, text=True) ``` ### Technical Analysis The `remove_from_list` command inserts the user-controlled contact name and group name directly into dynamically generated AppleScript source code. The implementation attempts to secure these values by escaping only double quotation marks. This is not a complete AppleScript string-encoding mechanism. In particular, existing backslashes, control characters, newlines, and AppleScript syntax may affect how the generated program is parsed. Although `subprocess.run` uses an argument list and therefore avoids shell interpretation at that boundary, the input remains untrusted code at the AppleScript interpreter boundary. The correct security boundary is not the shell but the dynamically generated AppleScript program. User values must be passed as data rather than interpolated into executable source. ### Attack Path 1. An attacker creates or causes the creation of a contact or group with a specially crafted name containing AppleScript string-breaking syntax. 2. The attacker or an automated agent invokes: ```bash python3 scripts/mac-contacts.py remove_from_list "<crafted-contact>" "<crafted-group>" ``` 3. The command replaces only double quotation marks and embeds the remaining value into the AppleScript source. 4. `osascript` parses the ...[truncated 919 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions Use a fixed AppleScript program and pass contact and group names through `osascript` arguments. Retrieve them from `argv` instead of concatenating them into source code. For example: ```python script = r''' on run argv set contactName to item 1 of argv set groupName to item 2 of argv tell application "Contacts" set theGroup to group groupName set thePeople to (every person in theGroup whose name is contactName) repeat with p in thePeople remove p from theGroup end repeat save end tell end run ''' result = subprocess.run( ["osascript", "-e", script, args.name, args.list], capture_output=True, text=True, check=False, ) ``` Additional hardening should include: 1. Prefer resolving the contact and group through stable identifiers rather than names. 2. Reject ambiguous contact matches before invoking Contacts.app. 3. Add regression tests for quotation marks, backslashes, newlines, Unicode separators, and AppleScript keywords. 4. Avoid printing raw interpreter errors if they may contain sensitive contact names or generated script fragments. 5. If practical, replace the AppleScript workaround with an API that supports structured parameters throughout. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/mac-contacts.py:429
• Finding: Ambiguous Name Matching Can Modify or Delete the Wrong Contact<![CDATA[ ## Vulnerability Details **File Location**: `scripts/mac-contacts.py:429-437`, `scripts/mac-contacts.py:487-503`, and `scripts/mac-contacts.py:514-522` **Vulnerability Type**: Unsafe object selection for destructive and state-changing operations **Risk Level**: Medium ### Vulnerable Code The update operation accepts every match but silently selects the first: ```python predicate = Contacts.CNContact.predicateForContactsMatchingName_(args.name) contacts, error = store.unifiedContactsMatchingPredicate_keysToFetch_error_(predicate, keys, None) if error or not contacts: print(f"Contact '{args.name}' not found.") sys.exit(1) contact = contacts[0].mutableCopy() ``` The delete operation has the same selection behavior: ```python predicate = Contacts.CNContact.predicateForContactsMatchingName_(args.name) contacts, error = store.unifiedContactsMatchingPredicate_keysToFetch_error_(predicate, keys, None) if error or not contacts: print(f"Contact '{args.name}' not found.") sys.exit(1) if not args.force: ans = input(f"Are you sure you want to delete '{args.name}'? [y/N] ") if ans.lower() != 'y': return save_request = Contacts.CNSaveRequest.new() save_request.deleteContact_(contacts[0].mutableCopy()) ``` Group assignment also selects the first result: ```python predicate = Contacts.CNContact.predicateForContactsMatchingName_(args.name) contacts, error = store.unifiedContactsMatchingPredicate_keysToFetch_error_(predicate, keys, None) if error or not contacts: print(f"Contact '{args.name}' not found.") sys.exit(1) contact = contacts[0] ``` ### Technical Analysis `predicateForContactsMatchingName_` can return multiple contacts and can match partial names. The implementation does not require an exact name, reject multiple results, or ask the caller to select a stable contact identifier. It instead uses `contacts[0]`. The order of returned contacts is not a safe authorization or identity-selection mechanism. Duplicate names, s ...[truncated 1645 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions Require unambiguous identity resolution before every state-changing operation: 1. Add `--id` support to `update`, `delete`, `add_to_list`, and `remove_from_list`. 2. Prefer a stable `CNContactIdentifierKey` value over a display name. 3. If name-based operation remains supported: - Return an error when more than one contact matches. - Display candidate names and identifiers. - Require the caller to rerun the operation with an identifier. 4. For interactive deletion, display the selected record's full name, identifier, organization, and a masked email or phone value. 5. Do not permit `--force` with an ambiguous name query. 6. Add tests with duplicate names and partial-name collisions. 7. Verify the selected contact is actually a member of the specified group before reporting successful removal. A safe pattern is: ```python if len(contacts) != 1: print("Error: contact name is ambiguous; use --id.") sys.exit(1) contact = contacts[0] ``` Identifier-based predicates should then be used for the final mutation. ]]>

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: scripts/mac-contacts.py:17
• Finding: Search Commands Fetch Unnecessary Sensitive Contact Fields<![CDATA[ ## Vulnerability Details **File Location**: `scripts/mac-contacts.py:17-38` and `scripts/mac-contacts.py:252` **Vulnerability Type**: Excessive sensitive-data access and failure to apply least privilege **Risk Level**: Medium ### Vulnerable Code A single comprehensive key list includes sensitive fields not required by many searches: ```python def get_keys_to_fetch(): """Returns a comprehensive list of keys to fetch for a complete CLI.""" return [ Contacts.CNContactIdentifierKey, Contacts.CNContactNamePrefixKey, Contacts.CNContactGivenNameKey, Contacts.CNContactMiddleNameKey, Contacts.CNContactFamilyNameKey, Contacts.CNContactNameSuffixKey, Contacts.CNContactNicknameKey, Contacts.CNContactOrganizationNameKey, Contacts.CNContactJobTitleKey, Contacts.CNContactDepartmentNameKey, Contacts.CNContactNoteKey, Contacts.CNContactPhoneNumbersKey, Contacts.CNContactEmailAddressesKey, Contacts.CNContactPostalAddressesKey, Contacts.CNContactUrlAddressesKey, Contacts.CNContactSocialProfilesKey, Contacts.CNContactBirthdayKey, Contacts.CNContactDatesKey, Contacts.CNContactThumbnailImageDataKey, ] ``` The search command uses this complete list regardless of the selected search mode: ```python def cmd_search(args): request_access() store = get_store() keys = get_keys_to_fetch() ``` ### Technical Analysis Narrow searches such as `--id`, `--email`, `--phone`, `--city`, `--country`, and `--list` do not require all of the requested fields. Nevertheless, each search requests notes, social profiles, birthdays, dates, URLs, and thumbnail image data. Some of these fields are not emitted by compact search output and are not required for matching. This violates data-minimization and least-privilege principles by bringing unrelated private information into process memory. Comprehensive free-text sear ...[truncated 1398 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions Define separate key lists for each operation and search mode: - Identifier lookup: identifier and fields needed for displayed output. - Email search: identifier, name, organization, email, and compact output fields. - Phone search: identifier, name, organization, phone, and compact output fields. - City or country search: identifier, name, organization, postal address, and compact output fields. - Group search: identifier and compact output fields. - Full `show`: comprehensive display fields. - Comprehensive text search: only fields actually searched and returned. Remove `CNContactThumbnailImageDataKey` unless image data is explicitly requested by a documented command. Do not fetch birthdays, custom dates, URLs, social profiles, or notes for searches that do not use them. Additional controls should include: 1. Clearly document which commands access notes and other sensitive fields. 2. Keep sensitive data out of logs and exception messages. 3. Avoid retaining contact objects longer than needed. 4. Add unit tests asserting that each command requests only its approved keys. 5. Consider making note searching an explicit opt-in flag because notes may contain highly sensitive free-form information. ]]>

T08 · Insecure Dependencies

Note

• Location: SKILL.md:30
• Finding: Third-Party Python Dependencies Are Installed Without Version or Hash Pinning<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:14`, `SKILL.md:30-34`, and `scripts/mac-contacts.py:10` **Vulnerability Type**: Unpinned third-party dependency installation **Risk Level**: Low ### Vulnerable Code and Instructions The compatibility metadata recommends mutable package releases: ```yaml Requires Python 3, pyobjc-framework-Contacts, and PyYAML (pip install pyobjc-framework-Contacts pyyaml). ``` The dependency instructions install the latest available versions without hashes: ```bash pip install pyobjc-framework-Contacts ``` ```bash pip install pyyaml ``` The runtime error message repeats the unpinned installation instruction: ```python print("Error: PyYAML is required. Run: pip install pyyaml", file=sys.stderr) ``` ### Technical Analysis The installation instructions do not specify reviewed package versions, package hashes, an index source, or a lock file. Consequently, the code installed by users can change after the Skill itself has been reviewed. This creates supply-chain risk because Python packages and their installation metadata can execute code during installation or provide code that executes when imported. The audit found no evidence that the named packages are intentionally malicious. The issue is that the installation process does not provide reproducibility or integrity verification. ### Attack Path 1. A user follows the documented `pip install` commands. 2. `pip` resolves the latest versions available from its configured package index. 3. A future compromised release, account takeover, unsafe configured index, or dependency-chain compromise supplies altered package code. 4. That code executes during installation or when the Skill imports `Contacts` or `yaml`. 5. The dependency receives the same process-level access as the Skill, including access to contact data after Contacts permission is granted. ### Impact Assessment A compromised dependency could execute arbitrary code with the current user's privilege ...[truncated 418 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions Use reproducible, integrity-checked dependency management: 1. Pin reviewed versions in a requirements file: ```text pyobjc-framework-Contacts==<reviewed-version> PyYAML==<reviewed-version> ``` 2. Generate and verify cryptographic hashes: ```text PyYAML==<reviewed-version> \ --hash=sha256:<reviewed-hash> ``` 3. Install with: ```bash python3 -m pip install --require-hashes -r requirements.txt ``` 4. Pin relevant transitive PyObjC components as well, preferably through a generated lock file. 5. Document the trusted package index and avoid implicit private-index fallback that could enable dependency confusion. 6. Recommend installation inside an isolated virtual environment. 7. Update the runtime error message to direct users to the locked requirements file rather than an unrestricted `pip install` command. 8. Use automated dependency scanning and controlled update reviews before changing pinned versions. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (16)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The declared description is for a contact-management CLI interacting with macOS Contacts. The supplied code chunk does not implement contact lookup, modification, deletion, or group management. Instead, it is infrastructure for running tests. While test code can be a supporting implementation detail for a larger project, this chunk’s actual behavior is materially different from the declared end-user functionality and exposes capabilities (executing arbitrary test scripts and summarizing results) not described in the skill purpose. Therefore this chunk does not accurately represent the declared description.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The skill description uses broad trigger language such as 'use whenever asked' for common contact-related requests, which can cause the agent to invoke this skill in many ordinary contexts without sufficiently narrowing for necessity, consent, or least privilege. Because the skill supports both sensitive data access and destructive actions, overbroad invocation increases the chance of unnecessary contact disclosure or unintended modification/deletion.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill documents create, update, delete, and list-management capabilities without warning that these actions are destructive or privacy-sensitive. In an agent setting, absence of a cautionary notice or confirmation requirement can lead to accidental contact changes, deletions, or mass organizational edits that are difficult for a user to notice or recover from.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 80% confidence
• Finding: The skill invokes local shell-executed commands (`python3 ...` and explicitly `osascript`) and requires privileged access to the user's Contacts database, but it declares no tool scope or permission boundaries. In an agent setting, missing explicit constraints increases the chance the skill is invoked with broader-than-necessary execution privileges and without informed consent around sensitive data access.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: This skill reads highly sensitive personal data from the macOS Contacts store, including phone numbers, emails, addresses, birthdays, notes, and group membership, but the description does not foreground a privacy warning. In agent workflows, that omission can lead to unintentional exposure of third-party personal data in responses, logs, or downstream tooling.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The create, update, delete, and list-management commands can permanently alter or remove contact data, yet the documentation does not clearly warn users about these side effects up front. In an agentic environment, insufficient emphasis on destructive behavior increases the risk of accidental modifications to a user's address book or synced iCloud/Exchange contacts.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The key-fetch list includes highly sensitive fields such as notes, birthdays, URLs, social profiles, dates, departments, job titles, and thumbnail image data, while the skill description focuses on basic lookup and management of names, contact details, addresses, and list membership. Over-collecting contact data increases privacy exposure and violates data minimization, especially because this tool can serialize and return those fields via `show`.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The `create` and `update` commands make persistent changes to the user's address book immediately after argument parsing, without a confirmation step or dry-run preview. In an agent context, that raises the risk of unintended or unauthorized modification of personal data if a prompt is ambiguous, manipulated, or misinterpreted.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The skill launches `osascript` to manipulate Contacts via AppleScript, which introduces general subprocess execution capability beyond the stated purpose of a Contacts CLI. Even though this instance is narrowly scoped, adding interpreter-backed execution increases attack surface and can create trust-boundary issues in agent environments where subprocess use is more sensitive than direct framework calls.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: Removing a contact from a list performs a state-changing action via `osascript` without explicit warning or confirmation. In an agent-driven workflow, silent mutation combined with external interpreter execution increases the chance of unintended changes and reduces user visibility into what will happen.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

f'  save\n'
        f'end tell'
    )
    result = subprocess.run(['osascript', '-e', script], capture_output=True, text=True)
    if result.returncode != 0:
        print(f"Error removing from list: {result.stderr.strip() or result.stdout.strip()}")
        sys.exit(1)

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The test script creates and deletes entries in the user's real macOS Contacts database without any explicit warning, sandboxing, or confirmation that personal address-book data will be modified. In the context of a contacts-management skill, this is risky because running tests against a live CNContactStore can alter real user data, create clutter, or accidentally delete similarly named contacts if matching is imperfect.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The script prints search and show command output directly to stdout, which may expose personal contact information such as names, emails, phone numbers, addresses, and internal contact IDs to logs, CI systems, terminal scrollback, or other observers. This is especially sensitive for a contacts skill because its normal operation handles PII, so test output can inadvertently leak real address-book contents when searches return non-fixture matches.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: This test performs a real write operation against the user's macOS Contacts database by creating a contact, but the script itself provides no in-file warning, isolation mechanism, or consent gate. In the context of an agent skill that may be run automatically, that is dangerous because it can silently modify personal data, pollute the address book, and create a dependency chain for later tests based on stateful side effects.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: This shell test invokes an update operation that changes contact fields such as organization, phone, birthday, and URL, which affects user data. Although the script logs command output, it does not include any warning, confirmation, or explanatory comment disclosing that it will modify address book records beyond the generic test label.

Description-Behavior Mismatch

Low

• Confidence: 92% confidence
• Finding: The generic search path matches against notes, organization, and full street/postal address content, which exceeds the declared search behavior of name, email, phone number, city, or country. This broadens the reachable sensitive data surface and may reveal contacts based on private notes or exact address details that users would not expect to be searched by default.

Static analysis

No suspicious patterns detected.