Drafts CLI

• Outcome: Review
• Latest audit: Sep 10, 2026 · 6:29 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent Drafts app helper, but it combines Drafts note access with an unpinned third-party CLI install and a broad activation trigger.

Install only if you intend to let a local CLI access and modify your Drafts notes through macOS Automation. Prefer a pinned reviewed release or verified commit/checksum before installing, and invoke the skill only for Drafts-specific tasks.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:27

Finding

Unpinned Third-Party CLI Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 27–34
Vulnerability Type: Unpinned executable dependency from a mutable remote source
Risk Level: Medium

bash

go install github.com/nerveband/drafts/cmd/drafts@latest

bash

git clone https://github.com/nerveband/drafts
cd drafts && go build ./cmd/drafts

Technical Analysis

Both documented installation methods retrieve and compile mutable repository content without pinning it to a reviewed version or immutable commit. The @latest directive may resolve to future code that was not available during this audit. Likewise, cloning the repository without checking out a specific commit builds whichever revision is present on its default branch at installation time.

No malicious dependency or deceptive source was identified: the repository URL is consistent with the homepage declared by the Skill. The vulnerability is the absence of version pinning and integrity verification, which leaves the effective executable outside the reviewed project and permits it to change after review.

Attack Path

1. An attacker compromises the upstream repository, a maintainer account, the release process, or another mechanism controlling the version selected as latest or the default branch.
2. The attacker introduces malicious behavior into the Drafts CLI source.
3. A user follows the documented setup command, causing Go or Git to retrieve the modified source.
4. The source is compiled and installed without commit, signature, or checksum verification.
5. The user invokes the resulting drafts executable and grants or has previously granted macOS Automation access.
6. The altered executable runs with the user's local privileges and can abuse the access available to the CLI.

Impact Assessment

Successful exploitation permits attacker-controlled code to execute under the installing user's account. The resulting executable could access or m ...[truncated 454 chars]

Remediation

View remediation

Remediation Suggestions

• Replace @latest with a reviewed semantic version or, preferably, an immutable commit or module version.
• Modify the source-build instructions to check out an explicitly reviewed release tag or commit before compilation.
• Publish expected SHA-256 checksums for release artifacts and require users to verify them before installation.
• Prefer signed release artifacts or signed tags and document signature verification using a trusted maintainer key.
• Record the reviewed dependency version in SKILL.md and update it only through a documented security-review process.
• Avoid recommending builds directly from a mutable default branch.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The manifest description says to use the skill when a user asks to "create a note, list drafts, search drafts, or manage their Drafts inbox," which is a broad natural-language trigger rather than a narrowly scoped invocation condition. It does not provide exclusions or clarify that requests must specifically target the Drafts app/CLI, increasing the chance of unintended activation for generic note-taking requests.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.