Apple Notes (AppleScript)

• Outcome: Review
• Latest audit: Sep 10, 2026 · 4:57 PM UTC
• Version: 1.1.0

Overview

This Apple Notes skill is purpose-related, but it needs review because it can modify/delete personal notes, silently export attachments, and contains input-handling bugs that could run unintended commands.

Review carefully before installing. Use only with trusted note names, folder names, queries, and limits; keep operations scoped to specific folders; back up Notes before edit/delete; and avoid read/attachment/PDF export workflows until exports use a private directory and require explicit user approval.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (5)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/notes-list.sh:29

Finding

AppleScript Injection Through Unvalidated Limit Arguments

Content

View full analysis

Remediation

View remediation

1000 )); then echo "Error: limit must be an integer between 1 and 1000" >&2 exit 1 fi ``` - Avoid generating AppleScript source from command-line values. Pass values through `osascript` arguments: ```bash osascript - "$LIMIT" <<'EOF' on run argv set maxCount to (item 1 of argv) as integer -- Remaining logic end run EOF ``` - Use a quoted heredoc delimiter so shell expansion cannot unexpectedly modify the AppleScript source. - Apply the same validation and argument-passing pattern in both `notes-list.sh` and `notes-search.sh`. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/notes-search.sh:52

Finding

AppleScript Injection in the Spotlight Search Branch

Content

View full analysis

&2 fi echo "Searching via Spotlight (OCR-enabled)..." >&2 results=$(mdfind "kMDItemTextContent == '*$QUERY*' && kMDItemContentType == 'com.apple.notes.note'" 2>/dev/null | head -$LIMIT) for notePath in $results; do noteName=$(basename "$notePath" .note) osascript <

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/notes-create.sh:48

Finding

AppleScript Injection Through Raw Folder Values in Output Statements

Content

View full analysis

$ESCAPED_TITLE" else set htmlBody to "

$ESCAPED_TITLE

" & bodyText end if set newNote to make new note at targetFolder with properties {name:"$ESCAPED_TITLE", body:htmlBody} set newId to id of newNote return "Created: $ESCAPED_TITLE" & linefeed & "Folder: $FOLDER" & linefeed & "ID: " & newId ``` ```bash # scripts/notes-delete.sh set searchTerm to "$ESCAPED_NAME" as text repeat with n in noteList if name of n contains searchTerm then set noteTitle to name of n try set noteFolder to name of container of n on error set noteFolder to "unknown" end try delete n return "Deleted: " & noteTitle & " (from " & noteFolder & ")" end if end repeat return "Error: No note matching '" & searchTerm & "' found in $FOLDER" ``` ### Technical Analysis Folder components used by `resolve_folder` are escaped before being inserted into folder lookup statements. However, both scripts later insert the original, unescaped `FOLDER` value into separate AppleScript string literals. A folder value containing a double quote and AppleScript syntax can close the string and alter the generated program. The escaping performed inside `_resolve_folder.sh` does not protect these later raw uses. In `notes-create.sh`, the vulnerable return statement is reached after a note is created successfully. In `notes-delete.sh`, the vulnerable return statement is reached when no matching note is found in the resolved folder. ### Attack Path 1. The attacker supplies a crafted folder argument containing a quote and AppleScript syntax. 2. `resolve_folder` safely escapes the value only while producing `FOLDER_SCRIPT`. ...[truncated 1033 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/notes-attachment.sh:35

Finding

Sensitive Note Attachments Exported to a Predictable Shared Temporary Directory

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/notes-export-pdf.sh:17

Finding

PDF Export Wrapper Can Return an Unrelated Stale Attachment

Content

View full analysis

/dev/null 2>&1 if [ $? -ne 0 ]; then exit 1 fi # Find the PDF file in output directory PDF_FILE=$(ls -t "$OUTPUT_DIR"/*.pdf 2>/dev/null | head -1) if [ -n "$PDF_FILE" ]; then echo "$PDF_FILE" else echo "Error: No PDF found for note '$NAME'" >&2 exit 1 fi ``` ### Technical Analysis The wrapper does not capture the exact file produced by the current extraction. Instead, after `notes-attachment.sh` exits successfully, it searches the shared export directory and returns whichever PDF has the newest modification time. `notes-attachment.sh` can exit successfully when a requested note has no attachments, when its attachments are images rather than PDFs, or when no PDF was extracted. In those cases, a PDF left by a previous operation can still match the wildcard and be returned. Concurrent invocations create an additional race: another process can place or export a PDF after extraction but before the `ls -t` command. ### Attack Path 1. A sensitive PDF from note A already exists in `/tmp/notes-export/`, or another process places a PDF there. 2. The victim requests PDF export for note B. 3. Note B exists, but it has no PDF attachment or only a preview image. 4. `notes-attachment.sh` completes with a successful status. 5. The wrapper runs `ls -t /tmp/notes-export/*.pdf`. 6. The stale or concurrently created PDF for note A is selected. 7. The wrapper reports that unrelated file as the export result for note B. ### Impact Assessment The caller may receive and subsequently disclose, upload, parse, or otherwise process a PDF belonging to a different note. This violates data isolati ...[truncated 233 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This skill exposes powerful read, search, edit, create, and delete operations over a large personal Apple Notes corpus, including categories that strongly imply sensitive content such as medical, receipts, property, and intimate material. The documentation provides operational guidance and performance tips but no explicit privacy warning, consent boundary, or destructive-action safeguards, which increases the chance an agent or user will access or modify highly sensitive data without informed approval.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The script writes extracted note attachments to a caller-controlled output directory, defaulting to /tmp, which creates a straightforward exfiltration path for note contents and attachments. In the context of a note-management skill, exporting attachments to arbitrary local paths is more dangerous because it enables copying sensitive documents and images outside the Notes trust boundary without strong safeguards or clear necessity for basic CRUD/search behavior.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script directly reads Apple Notes' private on-disk storage under the user's Library group container and derives attachment paths from internal account UUIDs and content identifiers. This expands the skill's effective capability beyond normal AppleScript note operations into raw filesystem access, enabling extraction of attachment data from private app storage in a way that is not obvious from the stated skill scope.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This shell script performs an irreversible delete operation on a matched Apple Notes item, but the code provides no confirmation prompt before deletion and no clear user-facing warning that the first partial match will be deleted immediately. The existing comments and usage text mention folder safety for search scope, but they do not disclose the destructive behavior strongly enough at the point of action.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The comment claims the script only shows attachment information, but the implementation actually copies attachment files to disk. This mismatch is security-relevant because users, reviewers, or calling agents may authorize a low-risk read action while the script performs higher-risk data exfiltration to local storage.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script enumerates the Apple Notes account container and prepares filesystem paths for attachment extraction without any invocation-time warning that reading a note may also access backing storage and export files. In a skill context, hidden side effects are especially risky because an agent or user may invoke a seemingly harmless read action and unintentionally disclose sensitive note attachments.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The script labeled as a read operation creates /tmp/notes-export and later copies note attachments there, which expands its behavior from passive read access to local data extraction and persistence. Writing potentially sensitive note attachments to a world-accessible or shared temporary location can expose private data to other local processes or users and increases the risk of unintended retention.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The copy operation writes extracted attachments to /tmp without explicit user consent or prominent disclosure. Temporary directories are commonly scanned, backed up, or accessed by other local tooling, so sensitive note content may be exposed beyond the original Notes application and retained longer than expected.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.