macos-suite-readonly
Analysis
This skill matches its read-only macOS query purpose, but it can expose private Mail, Calendar, and Notes information after macOS permission prompts.
Findings (4)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.
cmd = ["osascript", "-"] ... subprocess.run(cmd, input=input_text, text=True, capture_output=True)
The skill executes AppleScript through a local command runner, which is expected for macOS app queries but still gives the skill local automation capability.
Source: unknown; Homepage: none
The artifacts do not provide an external source repository or homepage for independent provenance checking.
Checks whether tool use, credentials, dependencies, identity, account access, or inter-agent boundaries are broader than the stated purpose.
读取邮件未读、日程、备忘录搜索 ... 首次调用可能弹出系统权限提示（自动化/隐私）。
The skill explicitly accesses personal Mail, Calendar, and Notes data through macOS privacy/automation permissions.
Checks for exposed credentials, poisoned memory or context, unclear communication boundaries, or sensitive data that could leave the user's control.
items.append({"title": r[0], "modified": r[1], "snippet": r[2]})Notes content is returned into the agent's context as data; note text, email subjects, or calendar titles could contain untrusted instructions if the agent over-trusts retrieved content.