Notesctl

PassAudited by VirusTotal on May 12, 2026.

Overview

Type: OpenClaw Skill Name: notesctl-skill-for-openclaw Version: 0.1.0 The skill is designed to manage Apple Notes on macOS using local scripts, `osascript`, and the `memo` CLI tool. All scripts (`notes_export.sh`, `notes_list.sh`, `notes_new.sh`, `notes_post.sh`, `notes_search.sh`) align with the stated purpose of creating, listing, searching, and exporting notes. Input is handled with Python-based escaping to prevent AppleScript injection, and there is no evidence of data exfiltration, malicious execution, persistence mechanisms, or prompt injection attempts against the OpenClaw agent in `SKILL.md` or `README.md`.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Concern

ASI05: Unexpected Code Execution

What this means

A maliciously crafted folder name passed to this script could potentially make the agent run unintended AppleScript on the user's Mac instead of only creating a note.

Why it was flagged

TITLE and BODY are escaped before use, but FOLDER is inserted directly into the AppleScript string. If a crafted folder value contains AppleScript syntax such as quotes or statement separators, it could change the command being executed.

Skill content

osascript -e "tell application \"Notes\" to make new note at folder \"$FOLDER\" with properties {name:\"$TITLE_AS\", body:\"$BODY_AS\"}"

Recommendation

Escape or strictly validate the folder name before building the AppleScript, or pass it through a safer AppleScript parameter mechanism. Avoid using untrusted text as the folder argument.

Note

ASI03: Identity and Privilege Abuse

What this means

The agent can read note listings/search results and create notes in the user's Apple Notes environment.

Why it was flagged

The skill intentionally operates on the user's Apple Notes data under the current macOS user's local app/account permissions.

Skill content

Manage Apple Notes via deterministic local scripts (create, append, list, search, export, and edit).

Recommendation

Install only if you are comfortable letting OpenClaw operate on Apple Notes, and review macOS permission prompts carefully.

Note

ASI06: Memory and Context Poisoning

What this means

Private note titles or contents may be displayed to or processed by the agent during search/export workflows.

Why it was flagged

The search script can retrieve Apple Notes content, including across folders when no folder is specified, which may bring private note text into the agent's context.

Skill content

if [[ -n "$FOLDER" ]]; then
  memo notes -f "$FOLDER" -s "$QUERY"
else
  memo notes -s "$QUERY"
fi

Recommendation

Use specific search terms and folders, and avoid asking the agent to search or export notes containing sensitive information unless needed.