Security audit
Security checks for vulnerabilities and agentic risk
This skill can read and change macOS Contacts, including deleting, merging, and restoring records, with safeguards that are too weak for its lower-risk description.
Install only if you are comfortable giving the skill authority over your local macOS Contacts, including update, delete, merge, and database restore workflows. Use it in a Review posture: prefer read/search and single-contact create operations, require explicit human confirmation before any update/delete/merge/restore, keep an independent Contacts backup, and avoid using the transaction, dedupe, or merge helpers until their scoping and input-safety issues are fixed.
scripts/contacts_dedupe.sh:16Python Source Injection Through Unquoted Heredoc Interpolation
scripts/contacts_backup.sh:9Live SQLite File Copy Produces Unreliable Backups and Rollbacks
scripts/contacts_merge.swift:126Merge Accepts Unrelated Identifiers and Deletes Unpreserved Contact Fields
The README advertises update, delete, merge/dedupe, backup/restore, and transactional mutation capabilities that exceed the stated skill scope of read/search/safely create contacts. This scope mismatch is dangerous because an agent or operator may rely on the README as authoritative usage guidance and invoke destructive operations that were not intended, reviewed, or permissioned under the published contract.
The design section explicitly describes native mutation paths, including Swift framework writes and AppleScript fallback, beyond the declared limited write scope. In an agent setting, undocumented alternate mutation paths increase risk because they can bypass user expectations and expand the effective attack surface for unauthorized or destructive contact changes.
The examples provide concrete commands for updating contacts and planning duplicate merges, which operationalizes behavior outside the stated read/search/create purpose. Executable examples are especially risky in agent ecosystems because they make misuse straightforward and can normalize destructive operations that users, orchestrators, or reviewers did not expect this skill to perform.
The README advertises update, delete, deduplication, merge, backup, and restore capabilities even though the declared skill scope is limited to read, search, and safe creation. This scope expansion is dangerous because operators or downstream agents may rely on the documentation and invoke destructive functionality that was not expected, reviewed, or consented to under the manifest, increasing the chance of unauthorized data modification or loss in a sensitive contacts datastore.
The transaction wrapper is documented as executing arbitrary commands supplied as arguments while also orchestrating backup and rollback. A skill marketed as simple contacts access should not silently include generic command-execution behavior, because that can be abused to run unintended shell commands under the guise of contact management.
The transaction wrapper is documented as executing arbitrary commands supplied as arguments while also orchestrating backup and rollback. A skill marketed as simple contacts access should not silently include generic command-execution behavior, because that can be abused to run unintended shell commands under the guise of contact management.
The transaction wrapper is documented as executing arbitrary commands supplied as arguments while also orchestrating backup and rollback. A skill marketed as simple contacts access should not silently include generic command-execution behavior, because that can be abused to run unintended shell commands under the guise of contact management.
The transaction wrapper is documented as executing arbitrary commands supplied as arguments while also orchestrating backup and rollback. A skill marketed as simple contacts access should not silently include generic command-execution behavior, because that can be abused to run unintended shell commands under the guise of contact management.
The transaction wrapper is documented as executing arbitrary commands supplied as arguments while also orchestrating backup and rollback. A skill marketed as simple contacts access should not silently include generic command-execution behavior, because that can be abused to run unintended shell commands under the guise of contact management.
The transaction wrapper is documented as executing arbitrary commands supplied as arguments while also orchestrating backup and rollback. A skill marketed as simple contacts access should not silently include generic command-execution behavior, because that can be abused to run unintended shell commands under the guise of contact management.
The manifest says the skill is limited to reading/searching and safe creation, but the body documents update, delete, dedupe, merge, backup, and restore operations. This security-documentation inconsistency is dangerous because it hides privileged and destructive behaviors behind a lower-risk description.
Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.
def cmd_exists(args):
env = os.environ.copy()
env.update({
'FN': args.first_name or '',
'LN': args.last_name or '',
Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.
def cmd_exists(args):
env = os.environ.copy()
env.update({
'FN': args.first_name or '',
'LN': args.last_name or '',
The script performs destructive deletion of contacts via contacts_txn.sh ... delete --identifier, which exceeds the declared skill scope of read/search/create-only behavior. This creates a capability mismatch: callers or reviewers may trust the skill as non-destructive while it can permanently remove contact records, increasing the chance of unauthorized or accidental data loss.
The script performs contact updates and deletions during apply-plan, which exceeds the skill metadata's stated write scope of 'safely create contacts'. This mismatch is dangerous because an agent or user relying on the manifest could grant or invoke the skill expecting additive-only behavior, while the code can irreversibly alter and remove existing sensitive records.
The script executes a CNSaveRequest that updates one contact and deletes others without any in-script confirmation, approval gate, or rollback support. Because duplicate detection is heuristic and merge content is synthesized, a mistaken or manipulated invocation could silently destroy contact data and merge incorrect phone/email fields into the wrong record.
The script directly overwrites the macOS Contacts SQLite database and related WAL/SHM files in the live AddressBook directory. This exceeds the declared read/search/create scope of the skill and can destroy or replace a user's local contacts data, enabling data loss or unauthorized rollback/injection of contact records if the backup source is untrusted or incorrect.
The restore operation overwrites local Contacts database files in place with no confirmation, preview, or warning about destructive consequences. In the context of a skill advertised as safe contact access and contact creation, this makes accidental or unauthorized data replacement especially dangerous because users would not reasonably expect a full database restore side effect.
The skill metadata says it is for reading, searching, verifying existence, and safely creating contacts, but the code also exposes full update and delete operations. This hidden capability materially expands the skill’s authority beyond user and orchestrator expectations, increasing the risk of unauthorized modification or destruction of a user’s address book if the skill is invoked or routed based on its declared purpose.
Delete support is especially risky because it enables irreversible destruction of personal data while being absent from the stated skill purpose. In an agent setting, undisclosed destructive functionality is dangerous because higher-level policy may permit this skill for benign contact lookup/creation tasks without anticipating silent deletion capability.
The wrapper executes whatever command and arguments are passed via "$@" with the script's privileges, rather than restricting execution to a specific Contacts write helper. In an agent skill context, this creates a generic command-execution primitive that can be abused to run unrelated programs, access other data, or trigger side effects far beyond contact creation.
The document states that writes must not directly modify the macOS contacts SQLite database, but it also documents restore and dedupe scripts that operate on contacts database/files outside the supported API path. That inconsistency can lead users or agents to bypass system safeguards, potentially corrupting the contacts store, violating platform expectations, or restoring stale/malicious data into a sensitive local database.
The README presents deletion and merge commands for contacts without an explicit warning that these actions are destructive and may be irreversible or lossy despite backup tooling. In the context of a production-grade contacts skill handling personal data, omission of confirmation requirements materially increases the risk of accidental bulk deletion, incorrect merges, and privacy-impacting data loss by human users or autonomous agents.
The skill advertises broad capabilities that imply shell, file access, and potentially network use, but it does not declare an explicit tool scope such as allowed-tools or permissions. That creates an avoidable trust gap: an agent may grant more capability than the manifest communicates, increasing the chance of unintended command execution or filesystem modification during contact operations.
This skill operates on the user's persistent macOS Contacts database, which is a long-lived personal data store. Any create, update, delete, backup, dedupe, or restore action affects durable state and can expose or alter sensitive personal information beyond the current session.
---
name: macos-contacts
description: Read, search, and safely create contacts in macOS Contacts (Address Book). Use when the user asks to inspect the native macOS contacts database, search contacts by name/phone/email/company, verify whether a contact exists, or add a new contact to Apple Contacts. Prefer this skill for production-grade contact access on macOS. Use SQLite for read-heavy search/list operations and AppleScript for writes, so reads stay fast and writes stay on supported system APIs.
---
# macOS Contacts
No suspicious patterns detected.