Apple Notes.Old

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 8:50 AM UTC
• Version: 1.0.0

Overview

This is a straightforward Apple Notes integration, with normal risks around installing a third-party CLI and deleting notes.

Install only if you trust the memo CLI source, review the Homebrew tap or repository before granting Automation access to Notes.app, and treat delete operations as potentially permanent unless you have a backup or have confirmed the selected note.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:15

Finding

Unpinned Third-Party CLI Installation Creates a Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 15–18 and 30–31
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Medium

Vulnerable Code Snippets

Homebrew installation metadata at lines 15–18:

json

{
  "id": "brew",
  "kind": "brew",
  "formula": "antoniorodr/memo/memo",
  "bins": ["memo"],
  "label": "Install memo via Homebrew"
}

Installation instructions at lines 30–31:

markdown

- Install (Homebrew): `brew tap antoniorodr/memo && brew install antoniorodr/memo/memo`
- Manual (pip): `pip install .` (after cloning the repo)

Technical Analysis

The skill instructs users to install executable third-party code from the antoniorodr/memo Homebrew tap without pinning an audited version, commit, package digest, or cryptographic signature. Consequently, the code installed later may differ from the dependency that was originally reviewed.

The manual alternative is similarly underspecified. It recommends pip install . after cloning a repository but provides no exact clone URL, revision, signed tag, or checksum. This command installs from whichever source tree is currently present and may execute package build or installation logic.

This is a supply-chain weakness rather than evidence that the named dependency is currently malicious. Exploitation requires compromise or substitution of the upstream tap, repository, release process, package metadata, or local checkout.

Attack Path

1. An attacker compromises the third-party Homebrew tap or source repository, publishes a malicious future release, or convinces the user to clone a substituted repository.
2. The user follows the documented unpinned Homebrew or pip installation instructions.
3. Homebrew or pip retrieves and installs the attacker-controlled package content.
4. Package installation logic or the resulting memo executable runs with the invoking user's privileges.
5. When the skill invokes memo, the malicious executable can acc ...[truncated 797 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to a specific audited version or immutable commit rather than installing the latest available release.
2. Provide the exact official repository URL for source-based installation.
3. Publish and verify a SHA-256 checksum or cryptographic signature for the expected package or source archive.
4. Prefer signed release tags and document signature-verification steps before installation.
5. Avoid the ambiguous pip install . instruction. Use an immutable source reference with hash verification and install only from a clean, verified checkout.
6. Regularly review the pinned dependency and update it through an explicit security review process.
7. Advise users to grant Apple Notes Automation permission only after verifying the installed executable and to revoke that permission when the integration is no longer needed.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill documents a note deletion command without any warning, confirmation guidance, or mention of irreversibility. In an agent setting, this increases the chance that a user or downstream automation invokes deletion casually and causes unintended loss of personal or business data stored in Apple Notes.

Content

No source excerpt is available for this finding.