macOS AppleScript Fallback (Reminders / Notes / Calendar / iMessage)
ReviewAudited by ClawScan on May 10, 2026.
Overview
The skill mostly does what it says, but it can send iMessages and create persistent Apple app data, with broad permission guidance and automatic account/calendar fallbacks that users should review.
Install only if you are comfortable letting the agent control local Apple apps to create persistent items and send iMessages. Before use, confirm recipients, message text, calendar/account names, and avoid granting Full Disk Access unless you have a specific, understood reason.
Findings (4)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
A calendar event or note could be created in the wrong account or calendar, including one that syncs to work, family, or shared devices.
The skill intentionally creates records in fallback destinations rather than failing or asking the user to confirm the actual target.
Calendar: if named calendar doesn’t exist, fallback to first calendar. Notes: if account `iCloud` is missing, fallback to default account.
Fail closed or ask for confirmation when the requested calendar/account is missing, and always report the exact destination used.
If invoked with the wrong recipient or text, the user's Messages account could send an unintended message.
The script sends a real iMessage through the local Messages app. This matches the skill purpose, but it is an external communication action.
send messageText to buddy targetBuddy of imService
Confirm the recipient and message text before sending, especially when the instruction is ambiguous or generated from prior context.
Granting Full Disk Access to the host application could expose much more local data than needed for creating reminders, notes, events, or messages.
Automation access to the named apps is expected, but Full Disk Access is a broad host-level permission and the artifact does not explain a bounded need for it.
Allow terminal/host app to control: Reminders, Notes, Calendar, Messages - Also allow Full Disk Access if your environment requires it
Grant only the specific Automation permissions needed for the target Apple apps; avoid Full Disk Access unless there is a clearly documented, user-approved reason.
Users or agents may install or invoke the skill in an unsupported environment, causing failures or confusing permission prompts.
The registry metadata does not declare the macOS-only environment or the osascript dependency, even though the included scripts require AppleScript on macOS.
OS restriction: none Required binaries (all must exist): none
Declare a macOS OS restriction and /usr/bin/osascript requirement in metadata so users know the runtime assumptions.