Security audit

macos-suite

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent macOS automation, but it needs Review because it can create Mail drafts with attachments and run caller-named Shortcuts without clear confirmation boundaries.

Review before installing. Only use this if you are comfortable granting a skill access to macOS app automation and local Mail, Notes, Calendar, Reminders, Photos, Freeform, Weather, and Stocks data. Be especially careful with Mail draft attachments and the shortcut= parameter; use trusted Shortcut names only and avoid letting untrusted content choose command arguments.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/main.py:192
Finding: Mail Draft Creation and Local File Attachment Bypass Explicit Confirmation
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: scripts/main.py:1041
Finding: Caller-Controlled Shortcut Name Can Invoke Arbitrary Existing macOS Shortcuts Without Confirmation
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (16)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The public description understates the skill's real behavior: it can send email, perform external network requests for stock/history data, and invoke Shortcuts, which can themselves trigger additional automations. This mismatch is dangerous because users, agents, or policy systems may authorize the skill based on an incomplete understanding, leading to unintended data exfiltration, outbound communication, or execution of higher-risk actions under the guise of benign app automation.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.
md
- Skill 目录以 `SKILL.md` 为核心（YAML frontmatter + 说明），并使用 `metadata` 单行 JSON 进行 gating（仅 darwin、需要 `python3/osascript`）。参见 OpenClaw 官方 Skills 规范：https://docs.opencl

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 15)May include surrounding context.
md
- Skill 目录以 `SKILL.md` 为核心（YAML frontmatter + 说明），并使用 `metadata` 单行 JSON 进行 gating（仅 darwin、需要 `python3/osascript`）。参见 OpenClaw 官方 Skills 规范：https://docs.opencl

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill advertises broad capabilities that include shell execution, file access, environment access, and network use, but it does not declare an explicit tool scope such as permissions or allowed-tools. In an agent setting, this weakens least-privilege boundaries and makes it harder for reviewers or enforcement layers to constrain what the skill may do, especially since the documented actions include reading local app data, creating content, and invoking system automation.
Content: No source excerpt is available for this finding.

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/main.py (reported line 76)May include surrounding context.
python
def _run(cmd, input_text=None): p = subprocess.run( cmd, input=input_text, text=True,

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The confirmation flow presents user-facing strings only in Chinese, including safety instructions and alternative action notes. This forces a specific language for an important interaction without user opt-in, which is a natural-language locale policy violation under the stated rules.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The mail-reading functions enumerate unread messages and return metadata such as subject, sender, date, and message ID without any additional in-skill privacy warning, minimization, or confirmation step. In an agent setting, this can expose sensitive communications content and relationship metadata to downstream components or logs with little user awareness.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The notes search command reads note titles, modification dates, and body snippets, including potentially highly sensitive personal or business information, without an explicit disclosure or confirmation workflow. Because it searches note bodies and returns content excerpts, misuse could directly exfiltrate confidential data from the local Notes database.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The calendar listing command returns event titles, times, and locations, which can reveal schedules, travel, meetings, and physical whereabouts, without any user-facing privacy notice or confirmation. In an automation-agent context this information is sensitive operational metadata and could be misused for profiling or surveillance.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The photos command accesses recent photo-library metadata such as dates, names, and favorites without any visible privacy disclosure or confirmation. Even without image bytes, this metadata can reveal personal habits, timelines, and sensitive events, especially when combined with other local-app data sources.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill performs direct outbound HTTP(S) requests to external stock-data providers even though the primary skill description emphasizes local macOS app automation. This expands the trust boundary and can leak user-requested stock symbols and usage patterns to third parties, creating an undeclared data-exposure and capability-expansion risk.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The stock quote/history features rely on external network access that is broader than simple local app automation and is not obviously disclosed by the skill description. This creates a data-flow risk to third-party services and adds remote dependency behavior that users may not expect from a macOS automation skill.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The natural-language interface exposed by the manifest is entirely in Chinese, including the description and all trigger patterns, with no indication that users may choose another language or that the skill is intentionally limited to a Chinese-speaking environment. This creates a locale/language policy concern because the skill appears to require a specific language without opt-in or documented justification.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The trigger list contains many broad, everyday phrases such as “地图”, “日历”, “照片”, “天气”, “股票”, and “画图”, which can match normal conversation rather than a clear request to invoke this skill. Because the skill has access to an exec-backed automation entrypoint and can interact with local apps that expose personal data or create/modify content, unintended invocation could lead to privacy exposure or accidental actions.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The natural-language content in the example board is entirely in Chinese, including the title and item text, with no indication that language choice is optional or user-selected. This can violate locale/language policy expectations when a skill implicitly constrains output to a specific language without documented opt-in or justification.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: For reminders fallback and weather retrieval, the code consults environment variables to locate user-configured Shortcuts. Reading environment configuration is not an obvious requirement of the manifest's stated scope of automating macOS apps like opening, reading, and creating content.
Content: No source excerpt is available for this finding.