Apple Notes

• Outcome: Review
• Latest audit: Sep 12, 2026 · 5:00 AM UTC
• Version: 1.0.1

Overview

The skill matches its Apple Notes purpose, but it relies on an unpinned third-party CLI that can access and mutate private notes, including deletion and export.

Install only if you trust the memo project and are comfortable giving it Apple Notes Automation access. Review the upstream package source or use a pinned, verified release where possible, and treat delete/export actions as sensitive: confirm the exact note before proceeding and revoke Automation permission when you no longer need the integration.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:4

Finding

Unpinned Third-Party CLI Installed from a Custom Homebrew Tap

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 4 and 12-13
Vulnerability Type: Supply-chain exposure through an unpinned third-party dependency
Risk Level: Medium

Vulnerable Code

text

homepage: https://github.com/antoniorodr/memo
metadata: {"clawdbot":{"emoji":"📝","os":["darwin"],"requires":{"bins":["memo"]},"install":[{"id":"brew","kind":"brew","formula":"antoniorodr/memo/memo","bins":["memo"],"label":"Install memo via Homebrew"}]}}
---

# Apple Notes CLI

Use `memo notes` to manage Apple Notes directly from the terminal. Create, view, edit, delete, search, move notes between folders, and export to HTML/Markdown.

Setup
- Install (Homebrew): `brew tap antoniorodr/memo && brew install antoniorodr/memo/memo`
- Manual (pip): `pip install .` (after cloning the repo)

Technical Analysis

The Skill instructs users or an Agent to install and execute the memo CLI from the third-party custom Homebrew tap antoniorodr/memo. Neither the Homebrew installation path nor the manual pip alternative pins an immutable release, commit, package hash, or cryptographic signature.

Consequently, the code installed at execution time may differ from the code that existed when the Skill was reviewed. The pip alternative also says to install after cloning “the repo” without specifying an exact repository URL, tag, or commit, increasing the chance of installing the wrong or a modified source tree.

This issue does not establish that the current upstream dependency is malicious. The risk arises because a compromised upstream repository, Homebrew tap, maintainer account, release process, or mutable package could distribute altered executable code. The exposure is particularly significant because the installed utility is intended to receive macOS Automation access to Apple Notes.

Attack Path

1. An attacker compromises the upstream repository, custom Homebrew tap, maintainer credentials, or relea ...[truncated 1308 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin memo to a reviewed, immutable release version and, where possible, an exact source commit.
2. Verify downloaded artifacts using a trusted cryptographic checksum or signature before installation.
3. Specify the complete official repository URL for manual installation and require checkout of an exact reviewed commit or signed tag before running pip install.
4. Avoid installing directly from a mutable branch or relying on an unversioned custom tap formula.
5. Document the expected package publisher, repository, release version, checksum, and verification procedure in SKILL.md.
6. Review the dependency and its transitive dependencies before granting macOS Automation access.
7. Grant Notes.app Automation permission only after package integrity has been verified, and revoke that permission when the integration is no longer needed.
8. Consider distributing a reproducibly built and signed artifact through a trusted package channel.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill exposes a destructive memo notes -d operation but does not explicitly warn that deletion may permanently remove note content or require clear user confirmation before proceeding. In an agent context, this increases the risk of accidental data loss because users may not understand the action is destructive or irreversible, especially when the command is presented as routine note management.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.