Security audit

Apple News (MacOS)

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent for Apple News automation, but its command examples leave crafted links or shortcut names insufficiently contained before local execution.

Review this before installing if you expect to open links from untrusted sources. Use only clearly valid Apple News links, require strict URL parsing, and ensure any agent executes open, osascript, and shortcuts with literal arguments rather than constructed shell strings. Shortcut-based search should remain opt-in and limited to Shortcuts whose side effects you understand.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

Location: operation-patterns.md:11
Finding: Command and AppleScript Injection Through Unsafe Input Interpolation
Content: View full analysis
" ``` ``` From `operation-patterns.md:11-16`: ```markdown ## Direct Link Open Pattern 1. Validate link format (`https://apple.news/...`). 2. Preview exact link before launch. 3. Open with `open -a /System/Applications/News.app ""`. 4. Confirm app foreground and link-open outcome. ``` ### Technical Analysis The documented workflows instruct the agent to substitute user-controlled links and locally discovered Shortcut names into command strings. The documentation does not define a strict URL parser, an allowed path grammar, a safe character policy for Shortcut names, or an argument-array execution requirement. Placing input inside shell double quotes is not sufficient protection. Shell constructs such as command substitution can still be interpreted if an implementation constructs a command string and invokes it through a shell. A malicious value containing syntax such as `$()` or backticks could therefore execute an additional command rather than remaining a literal argument. The AppleScript fallback presents an additional interpreter boundary. A URL is embedded directly inside AppleScript source passed to `osascript -e`. If a dynamic value can terminate t ...[truncated 1717 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep