T09 · Insecure Skill Coding Practices
Error
- Location
scripts/apple_notes.py:67- Finding
AppleScript Injection Through Unescaped Account and Folder Values
- Content
View full analysis
- Remediation
View remediation
Security audit
apple-notes-writer
Security checks for vulnerabilities and agentic risk
Overview
This Apple Notes skill mostly matches its stated purpose, but it can read and overwrite personal notes and contains unsafe AppleScript construction that could execute unintended local automation commands.
Install only if you are comfortable granting a local automation skill access to Apple Notes. Treat note titles, folder names, account names, and note IDs as sensitive inputs; avoid using untrusted text for them until the AppleScript interpolation is fixed. Use explicit confirmation before writes or updates, especially update-by-ID, and be aware the skill can read and list existing notes as well as create them.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
REFERENCE.md:32- Finding
Documentation Promotes Unsafe AppleScript String Interpolation
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Note
- Location
PUBLISH.md:30- Finding
Unpinned Global npm Package Installation in Publishing Instructions
- Content
View full analysis
- Remediation
View remediation
``` 2. Document the expected package publisher, registry, and reviewed version. 3. Verify package provenance and integrity before installation. 4. Prefer a project-local development dependency with a lockfile where operationally possible. 5. Consider invoking the pinned package through a controlled package script rather than modifying the global executable environment. 6. Review release notes and package contents before changing the pinned version. 7. Advise users not to run npm with elevated privileges. ]]>
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (26)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 92% confidence
- Finding
The declared purpose emphasizes writing formatted notes, but the content also exposes undeclared read and list capabilities for Notes. That mismatch is dangerous because users and reviewers may consent to a write-only skill while the actual behavior can enumerate or retrieve note contents, increasing privacy risk and expanding the skill's effective access beyond expectations.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The manifest description says the skill supports Markdown conversion and multi-folder management, but the documented implementation only accepts
content_htmland always targetsfolder "Notes" of account "iCloud". No Markdown parsing/conversion logic or selectable folder parameter is present in the code sample, so the stated capabilities are not reflected by actual behavior.- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The guidance states that
<should become<and>should become>, yet the core function is explicitly designed to pass HTML tags such as<h1>,<p>, and<div>into Apple Notes unchanged. Escaping angle brackets as documented would prevent the advertised HTML formatting behavior, so the documentation directly contradicts the code's intended operation.- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The trigger list uses broad, everyday phrases that could cause the skill to activate when a user is only discussing note-taking rather than authorizing a system write action. In this context, broad invocation is more dangerous because the skill performs real side effects on the host by launching AppleScript and modifying Apple Notes.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill automates local system actions that create or overwrite Apple Notes via osascript, but the documentation does not clearly warn that using it modifies data on the user's macOS system. That increases the risk of users invoking it without informed consent, leading to unintended note creation, overwrites, or data integrity issues.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 91% confidence
- Finding
The skill documents shell and file-reading style capabilities through example commands and code, but it does not declare any explicit tool scope such as allowed-tools or permissions. This creates an authorization and review gap: an agent may invoke broader capabilities than users or platform policy expect, especially when the skill includes subprocess/osascript usage and file-based Markdown input.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The natural-language content of the skill, including description, usage, triggers, and workflow, is presented exclusively in Chinese. There is no indication that the user can choose another language or that this language restriction is required for a region-specific purpose.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The trigger phrases are broad and map to common note-taking language without exclusions or confirmation constraints. This can cause unintended invocation of a shell-capable macOS automation skill for ordinary user requests, increasing the chance of writing, updating, or reading Notes when the user did not explicitly intend to use this integration.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The manifest description emphasizes writing to Apple Notes with formatting support, but this example also enumerates existing notes and reads note contents. Those are additional read capabilities that go beyond a purely write-focused skill description.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This Python file performs a data-modifying write to Apple Notes, including
update_existing=True, which can overwrite existing note content. While there is a progress print statement, there is no user-facing warning about the data modification risk or overwrite behavior in comments, docstrings, or a confirmation prompt.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The write path creates or updates user notes immediately with no confirmation, preview, or safety notice. In an agent skill, state-changing operations against personal data should be clearly signaled because mistakes, prompt misuse, or malicious upstream inputs can cause unintended data modification.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python # 构建并执行AppleScript script = self._build_applescript(title, content, folder, update_existing) result = subprocess.run( ['osascript', '-e', script], capture_output=True, text=True
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python # 构建并执行AppleScript script = self._build_applescript(title, content, folder, update_existing) result = subprocess.run( ['osascript', '-e', script], capture_output=True, text=True
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python # 构建并执行AppleScript script = self._build_applescript(title, content, folder, update_existing) result = subprocess.run( ['osascript', '-e', script], capture_output=True, text=True
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python # 构建并执行AppleScript script = self._build_applescript(title, content, folder, update_existing) result = subprocess.run( ['osascript', '-e', script], capture_output=True, text=True
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python # 构建并执行AppleScript script = self._build_applescript(title, content, folder, update_existing) result = subprocess.run( ['osascript', '-e', script], capture_output=True, text=True
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python # 构建并执行AppleScript script = self._build_applescript(title, content, folder, update_existing) result = subprocess.run( ['osascript', '-e', script], capture_output=True, text=True
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill is presented as an Apple Notes writer, but it also reads note bodies, lists note titles, and exposes note identifiers. That mismatch increases the risk of unintended data access and exfiltration because a caller may grant or invoke the skill expecting write-only behavior while it can also inspect existing personal notes.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The combination of get_note_id and update_by_id enables arbitrary modification of existing notes once an identifier is known. In skill context, this is more dangerous than a normal note-writer because it permits targeting preexisting user data outside the expected create/update-by-title workflow, making silent overwrite or tampering easier.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
Updating by note ID overwrites note content directly and is especially risky because IDs enable precise targeting of existing notes. In the context of a personal-notes integration, lack of user confirmation or versioning can lead to irreversible loss or tampering of sensitive data.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This markdown file contains user-facing instructions exclusively in Chinese, and there is no indication that the skill is intended only for a Chinese-speaking audience or that users may choose another language. That can violate a language/locale policy requiring opt-in or documented justification for language constraints.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The primary skill description is written in Chinese with no indication that other languages are supported or that the language choice is intentional for a region-specific audience. This can violate language/locale policy when a skill imposes a specific language without user opt-in.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This code file contains user-facing natural language in Chinese throughout the docstring, comments, and printed output. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation, and there is no indication here that the skill is region-specific or that users can choose another language.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
The file’s user-facing natural-language content and labels are entirely in Chinese, which may impose a language choice on users without opt-in. The policy allows locale constraints when explicitly offered as a choice or clearly justified, which is not present here.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 77% confidence
- Finding
This code writes content into Apple Notes, which affects user data by creating a note. Although the script prints status messages, it does not explicitly disclose that it will persist content into the user's Notes account or local Notes store.
- Content