T03 · Remote Payload Retrieval and Execution
Error
- Location
USAGE.md:156- Finding
Remote Homebrew installer is piped directly into a shell
- Content
View full analysis
- Remediation
View remediation
Security audit
Apple Notes Extractor
Security checks for vulnerabilities and agentic risk
Overview
This Apple Notes exporter is mostly purpose-aligned, but it needs review because some paths automatically install unpinned third-party code and the docs encourage persistent or external handling of private notes despite local-only privacy claims.
Review carefully before installing. Use only the simple local extraction path unless you have vetted the third-party Ruby parser, avoid the auto/full mode until dependencies are pinned or manually reviewed, and do not enable cron, daemon, AI, Notion, Git, or remote-backup workflows without deciding exactly which notes may be copied, where they will be stored, and how they can be deleted.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Findings (4)
T08 · Insecure Dependencies
Error
- Location
scripts/extract-notes.py:225- Finding
Full extraction automatically installs and executes unpinned third-party code
- Content
View full analysis
- Remediation
View remediation
T06 · System Persistence
Warning
- Location
AUTOMATION_INTEGRATION.md:88- Finding
Documentation encourages persistent scheduled extraction of private Notes
- Content
View full analysis
> logs/daily-extraction.log 2>&1 # Real-time monitoring (every 30 minutes during work hours) */30 9-17 * * 1-5 cd /Users/saiterminal/.openclaw/workspace-genai-research/apple-notes-extractor && python3 scripts/monitor-notes.py --check-once # Weekly full extraction with attachments (Sundays at 2 AM) 0 2 * * 0 cd /Users/saiterminal/.openclaw/workspace-genai-research/apple-notes-extractor && python3 scripts/extract-notes.py --method full ``` A second documented example is: ```bash # Add to crontab for daily export at 9 AM 0 9 * * * cd /path/to/apple-notes-extractor && python3 scripts/extract-notes.py --method auto && python3 scripts/workflow-integrator.py ``` ### Technical Analysis The project does not silently install these cron entries; users must add them explicitly. Nevertheless, the production instructions encourage recurring, cross-session access to private Notes and repeated creation of plaintext exports. The scheduled full-extraction job is particularly sensitive because it can invoke the automatic third-party parser installation and execution path. Scheduled execution also means a later modification of the project or its dependencies can run without contemporaneous user review. Scheduling is a legitimate optional feature for monitoring and automated export, but it is unnecessary for one-time extraction and materially expands the duration and frequency of access. ### Attack Path 1. A user follows the deployment instructions and installs one or more cron entries. 2. The jobs continue to run across terminal se ...[truncated 905 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
INTEGRATION.md:47- Finding
Local-only privacy assurances conflict with integrations that transmit Notes externally
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (51)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
If the skill sends outbound webhook notifications while claiming only local Apple Notes monitoring, it introduces undeclared network exfiltration risk for note-derived data or metadata. Even if only metadata is transmitted, users handling personal or corporate notes could unknowingly leak sensitive information to external endpoints.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 90% confidence
- Finding
If the skill sends outbound webhook notifications while claiming only local Apple Notes monitoring, it introduces undeclared network exfiltration risk for note-derived data or metadata. Even if only metadata is transmitted, users handling personal or corporate notes could unknowingly leak sensitive information to external endpoints.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 93% confidence
- Finding
If the skill sends outbound webhook notifications while claiming only local Apple Notes monitoring, it introduces undeclared network exfiltration risk for note-derived data or metadata. Even if only metadata is transmitted, users handling personal or corporate notes could unknowingly leak sensitive information to external endpoints.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
If the skill sends outbound webhook notifications while claiming only local Apple Notes monitoring, it introduces undeclared network exfiltration risk for note-derived data or metadata. Even if only metadata is transmitted, users handling personal or corporate notes could unknowingly leak sensitive information to external endpoints.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md ./scripts/setup.sh
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill is described as a notes extraction/export utility, but it also clones and installs third-party tooling from GitHub during execution. That hidden capability materially changes the trust boundary by introducing network access and external code execution that users would not reasonably expect from the stated functionality.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
Runtime network access and package installation are unnecessary and dangerous capabilities for a local notes extraction workflow. In a skill that handles private Notes content, this is especially risky because a compromised dependency chain could execute code in the same environment that has access to sensitive personal data.
- Content
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 95% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
sh if python3 scripts/extract-notes.py --method simple --output-dir output/test 2>/dev/null; then print_success "Basic extraction test successful" # Clean up test output rm -rf output/test 2>/dev/null || true else print_warning "Basic extraction test failed. You may need to configure permissions." fi
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The document presents Apple Notes extraction and monitoring as production-ready automation without any prominent consent, retention, or sensitivity warning, despite Apple Notes commonly containing personal, financial, medical, or credential-adjacent data. This can normalize persistent collection of highly sensitive note content and lead users to enable broad access without understanding the privacy implications.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The cron job examples enable unattended recurring extraction and monitoring, which creates continuous background collection and local logging/storage of note content without clearly warning the user. In the context of a personal notes integration skill, this is especially risky because it turns an inherently sensitive data source into an always-on feed for other systems.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The instructions append extracted note insights into memory files, effectively propagating private note content into additional long-term systems where access controls, deletion behavior, and downstream reuse may differ. This increases exposure and persistence of sensitive information beyond the original Notes app, making accidental disclosure or over-collection more likely.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 70% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md 'folder': note['folder'] } requests.put( f"http://localhost:9200/notes/_doc/{note['id']}", json=doc )
Internal Network Request
Medium
- Category
- Server-Side Request Forgery
- Confidence
- 70% confidence
- Finding
Code issues a request to a loopback, link-local, or private-range host. This can reach internal services not meant to be exposed and is a common SSRF pivot.
- Content
md 'folder': note['folder'] } requests.put( f"http://localhost:9200/notes/_doc/{note['id']}", json=doc )
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The guide includes an AI processing example that sends note body content to an external LLM service without an explicit privacy warning, consent step, or data-minimization guidance. Because Apple Notes commonly contains sensitive personal or business information, this can lead users to unintentionally disclose confidential data to third parties.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The automated backup example commits extracted notes to git and uploads them to a remote server, but it does not warn about long-term persistence, replication, or unauthorized access risks. Users may unknowingly publish or replicate highly sensitive note contents into systems with weaker access controls or broader retention.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The Notion migration example transmits note titles and body content to a third-party SaaS platform without an explicit disclosure warning. This creates a real privacy and compliance risk because users may transfer sensitive Apple Notes data into an external system with different sharing, retention, and access properties.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 90% confidence
- Finding
The hardcoded Notion API endpoint indicates note content will be transmitted to an external SaaS provider. While the endpoint itself is not malicious, the surrounding example facilitates data export of sensitive note content without prominent warnings or privacy controls.
- Content
md DATABASE_ID = "your-database-id" def create_notion_page(note): url = "https://api.notion.com/v1/pages" headers = { "Authorization": f"Bearer {NOTION_TOKEN}", "Content-Type": "application/json",
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 91% confidence
- Finding
The code posts note-derived content to the Notion API, transferring potentially sensitive user data to a third-party service. In the context of an Apple Notes extractor, this is dangerous because notes frequently contain private, regulated, or business-confidential information, and the example lacks safeguards or warnings.
- Content
md ] } return requests.post(url, headers=headers, json=data) # Load and migrate notes with open('output/json/notes_auto_latest.json') as f:
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This checklist promotes automated extraction, monitoring, indexing, backup, and AI summarization of Apple Notes without any explicit warning about the sensitivity of note contents, retention, sharing boundaries, or consent requirements. In the context of Apple Notes, users commonly store passwords, personal records, financial details, and other highly sensitive data, so normalizing broad workflow integration and version-controlled backups materially increases privacy and data-exposure risk.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 95% confidence
- Finding
The skill declares no explicit tool scope or permissions even though it instructs use of Python, osascript, shell commands, file writes, and package installation. This is dangerous because it obscures the true capability boundary of a skill that accesses private Apple Notes data and writes exports to disk, reducing informed user consent and making over-privileged execution more likely.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill encourages bulk extraction and export of Apple Notes without a prominent warning that notes may contain highly sensitive personal, financial, health, legal, or corporate information that will be copied into local files or downstream tools. In this context, omission of a clear warning materially increases the chance of accidental data sprawl and inappropriate handling of sensitive content.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The monitoring and auto-export instructions omit a warning that continuous monitoring can capture future note edits and persist them to other locations over time. This is especially risky for Apple Notes because users may later add credentials, personal records, or confidential work material, which would then be silently propagated to archives or third-party knowledge stores.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The documentation tells users where extracted notes are saved but does not clearly warn that these files may contain highly sensitive personal content from Apple Notes. In this skill context, the omission is more dangerous because the tool explicitly bulk-extracts private notes into JSON and markdown files that could be indexed, synced, backed up, or exposed to other local users/processes.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The monitoring and daemon instructions encourage continuous or repeated processing of private notes without clearly warning users about the privacy implications of ongoing collection. In a note-extraction skill, background monitoring increases risk by widening the window for capturing sensitive content and silently generating updated exports over time.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The guide asserts that all processing is local and no data is sent externally, yet it instructs the user to fetch and execute a remote installer script from GitHub via curl-to-bash. That claim is misleading because setup requires network access and execution of unreviewed remote code, which could be tampered with or behave unexpectedly.
- Content
Static analysis
No suspicious patterns detected.