Security audit
Security checks for vulnerabilities and agentic risk
This skill is a legitimate macOS Contacts manager, but it needs review because it can expose and persistently change sensitive contact data with weak safeguards.
Install only if you are comfortable granting the agent host access to your macOS Contacts. Before using write actions, manually confirm the exact contact, prefer stable IDs where available, avoid ambiguous names, and be cautious running the bundled tests because they modify the real Contacts database.
scripts/mac-contacts.py:570AppleScript Injection Through Contact and Group Names
scripts/mac-contacts.py:429Ambiguous Name Matching Can Modify or Delete the Wrong Contact
scripts/mac-contacts.py:17Search Commands Fetch Unnecessary Sensitive Contact Fields
SKILL.md:30Third-Party Python Dependencies Are Installed Without Version or Hash Pinning
The declared description is for a contact-management CLI interacting with macOS Contacts. The supplied code chunk does not implement contact lookup, modification, deletion, or group management. Instead, it is infrastructure for running tests. While test code can be a supporting implementation detail for a larger project, this chunk’s actual behavior is materially different from the declared end-user functionality and exposes capabilities (executing arbitrary test scripts and summarizing results) not described in the skill purpose. Therefore this chunk does not accurately represent the declared description.
The skill description uses broad trigger language such as 'use whenever asked' for common contact-related requests, which can cause the agent to invoke this skill in many ordinary contexts without sufficiently narrowing for necessity, consent, or least privilege. Because the skill supports both sensitive data access and destructive actions, overbroad invocation increases the chance of unnecessary contact disclosure or unintended modification/deletion.
The skill documents create, update, delete, and list-management capabilities without warning that these actions are destructive or privacy-sensitive. In an agent setting, absence of a cautionary notice or confirmation requirement can lead to accidental contact changes, deletions, or mass organizational edits that are difficult for a user to notice or recover from.
The skill invokes local shell-executed commands (python3 ... and explicitly osascript) and requires privileged access to the user's Contacts database, but it declares no tool scope or permission boundaries. In an agent setting, missing explicit constraints increases the chance the skill is invoked with broader-than-necessary execution privileges and without informed consent around sensitive data access.
This skill reads highly sensitive personal data from the macOS Contacts store, including phone numbers, emails, addresses, birthdays, notes, and group membership, but the description does not foreground a privacy warning. In agent workflows, that omission can lead to unintentional exposure of third-party personal data in responses, logs, or downstream tooling.
The create, update, delete, and list-management commands can permanently alter or remove contact data, yet the documentation does not clearly warn users about these side effects up front. In an agentic environment, insufficient emphasis on destructive behavior increases the risk of accidental modifications to a user's address book or synced iCloud/Exchange contacts.
The key-fetch list includes highly sensitive fields such as notes, birthdays, URLs, social profiles, dates, departments, job titles, and thumbnail image data, while the skill description focuses on basic lookup and management of names, contact details, addresses, and list membership. Over-collecting contact data increases privacy exposure and violates data minimization, especially because this tool can serialize and return those fields via show.
The create and update commands make persistent changes to the user's address book immediately after argument parsing, without a confirmation step or dry-run preview. In an agent context, that raises the risk of unintended or unauthorized modification of personal data if a prompt is ambiguous, manipulated, or misinterpreted.
The skill launches osascript to manipulate Contacts via AppleScript, which introduces general subprocess execution capability beyond the stated purpose of a Contacts CLI. Even though this instance is narrowly scoped, adding interpreter-backed execution increases attack surface and can create trust-boundary issues in agent environments where subprocess use is more sensitive than direct framework calls.
Removing a contact from a list performs a state-changing action via osascript without explicit warning or confirmation. In an agent-driven workflow, silent mutation combined with external interpreter execution increases the chance of unintended changes and reduces user visibility into what will happen.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
f' save\n'
f'end tell'
)
result = subprocess.run(['osascript', '-e', script], capture_output=True, text=True)
if result.returncode != 0:
print(f"Error removing from list: {result.stderr.strip() or result.stdout.strip()}")
sys.exit(1)
The test script creates and deletes entries in the user's real macOS Contacts database without any explicit warning, sandboxing, or confirmation that personal address-book data will be modified. In the context of a contacts-management skill, this is risky because running tests against a live CNContactStore can alter real user data, create clutter, or accidentally delete similarly named contacts if matching is imperfect.
The script prints search and show command output directly to stdout, which may expose personal contact information such as names, emails, phone numbers, addresses, and internal contact IDs to logs, CI systems, terminal scrollback, or other observers. This is especially sensitive for a contacts skill because its normal operation handles PII, so test output can inadvertently leak real address-book contents when searches return non-fixture matches.
This test performs a real write operation against the user's macOS Contacts database by creating a contact, but the script itself provides no in-file warning, isolation mechanism, or consent gate. In the context of an agent skill that may be run automatically, that is dangerous because it can silently modify personal data, pollute the address book, and create a dependency chain for later tests based on stateful side effects.
This shell test invokes an update operation that changes contact fields such as organization, phone, birthday, and URL, which affects user data. Although the script logs command output, it does not include any warning, confirmation, or explanatory comment disclosing that it will modify address book records beyond the generic test label.
The generic search path matches against notes, organization, and full street/postal address content, which exceeds the declared search behavior of name, email, phone number, city, or country. This broadens the reachable sensitive data surface and may reveal contacts based on private notes or exact address details that users would not expect to be searched by default.
No suspicious patterns detected.