Security audit
Security checks for vulnerabilities and agentic risk
This AirDrop skill is mostly coherent, but its optional Shortcut mode can run any named local macOS Shortcut and is broader than a simple AirDrop helper.
Review this before installing if you plan to use Shortcut mode. Direct mode opens the native AirDrop chooser for explicit local files, but Shortcut mode trusts the named macOS Shortcut and whatever actions that Shortcut contains. Use only shortcuts you created or audited, keep sensitive-file confirmations enabled, and avoid broad activation preferences if you do not want file-transfer behavior triggered by vague sharing requests.
The security manifest materially understates behavior: in --shortcut mode the script delegates control to any user-specified macOS Shortcut, which may read, write, execute apps, or perform network actions. In an agent/tooling context, inaccurate manifests can mislead policy engines or reviewers into granting this skill broader trust than its runtime behavior warrants.
The exposed interface advertises an AirDrop sender but also offers a generic Shortcut execution path, expanding capability well beyond the stated purpose. In a security-sensitive agent environment, this kind of capability mismatch is dangerous because callers may invoke the skill assuming only local AirDrop behavior while actually enabling arbitrary automation flows.
This code allows execution of any installed Shortcut by name and passes attacker-controlled file inputs into it. Because macOS Shortcuts can trigger wide-ranging side effects such as file operations, application control, shell actions, and network access, this creates a broad automation primitive that is substantially more dangerous than an AirDrop helper, especially if an agent can be induced to call it.
The activation rule is broad enough to trigger on generic requests about sharing or handing off files to Apple devices, which can cause the skill to activate in situations the user did not explicitly intend. In a file-transfer skill, unintended activation matters because it can steer the assistant toward local file handling, preference capture, and transfer preparation based on ambiguous phrasing, increasing the chance of privacy mistakes or accidental disclosure.
The instruction to "Start naturally" is coupled with the entire file being written as mandatory English interaction guidance, with no indication that the user may choose another language or locale. Under the policy, forcing a specific language without opt-in can be a natural-language policy violation.
No suspicious patterns detected.
