Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The skill claims to manage Apple Notes via AppleScript, which reasonably requires macOS and an AppleScript runtime (e.g., the osascript binary). The registry metadata lists no required binaries and no OS restriction; that is inconsistent with the stated purpose. Additionally, the SKILL.md includes a static list of 'Available Folders' that appears to be system-specific, which is unexpected for a generic CLI doc.
Instruction Scope
SKILL.md is an instruction-only document describing CLI commands (notectl) but does not include explicit runtime steps (e.g., run osascript or where to get the CLI). It implicitly requires the agent or user to run AppleScript against the local Notes database, which would read and write user data — the document does not discuss permissions or safety, leaving runtime behavior vague.
Install Mechanism
No install spec and no bundled code — lowest installer risk. Nothing will be written to disk by an installer because there is no install step described.
Credentials
The skill requests no environment variables or credentials, which is plausible for a locally run AppleScript-based tool. However, it fails to declare required platform/binaries (macOS and osascript), and the embedded folder list suggests the package may contain or have been generated from user-specific data — which is disproportionate and unexpected for a generic published skill.
Persistence & Privilege
The skill does not request persistent or elevated platform privileges (always: false). It is user-invocable and allows normal model invocation, which is standard.
What to consider before installing
This skill is coherent in purpose (manage Apple Notes) but has worrisome omissions and a surprising static folder list. Before installing or enabling it: (1) verify the publisher/source (there's no homepage and source is unknown); (2) confirm you are on macOS and that the skill will use a trusted AppleScript runtime (osascript) — the skill should declare this; (3) ask the author why a list of local folders is embedded in SKILL.md (it may indicate the packaged skill contains user-specific data); (4) avoid enabling autonomous execution unless you trust the skill, because it could read/write your local Notes via AppleScript. If the author cannot justify the missing platform requirement and the folder list, treat the skill as untrusted.Like a lobster shell, security has layers — review code before you run it.
latestvk979979h4dp944w9yzqewwgzc97zm5gh
License
MIT-0
Free to use, modify, and redistribute. No attribution required.