Apple Notes

• Outcome: Review
• Latest audit: Sep 10, 2026 · 4:12 AM UTC
• Version: 1.0.0

Overview

This Apple Notes skill is purpose-aligned, but it asks users to install an unpinned third-party CLI and grant it access to sensitive Notes data with limited safety guidance.

Review this skill before installing. Only use it if you trust the memo CLI source, understand that Automation permission can expose and modify your Apple Notes, and are prepared to confirm destructive actions like note deletion carefully.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:4

Finding

Unpinned Third-Party CLI Installation Without Integrity Verification

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 4 and 13-14
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

yaml

homepage: https://github.com/antoniorodr/memo

markdown

- Install (Homebrew): `brew tap antoniorodr/memo && brew install antoniorodr/memo/memo`
- Manual (pip): `pip install .` (after cloning the repo)

Technical Analysis

The Skill directs users to install and execute the third-party memo CLI from a personal GitHub Homebrew tap or from an unspecified cloned repository. Neither installation method pins an audited release or commit, and the instructions do not require verification using a checksum, package signature, or equivalent integrity control.

Consequently, the dependency's effective code can change after this Skill has been audited. A compromise of the upstream repository, Homebrew tap, release process, or an incorrectly sourced manual clone could cause attacker-controlled code to execute during installation or subsequent memo invocations.

The manual instruction is particularly ambiguous because it does not provide an exact clone URL, revision, or verification procedure. Running pip install . installs code from whichever working tree the user happens to have cloned.

Attack Path

1. An attacker compromises the upstream repository, Homebrew tap, maintainer account, or package publication process. Alternatively, a user clones an unofficial or attacker-controlled repository because the manual installation source is unspecified.
2. The attacker introduces malicious installation or runtime code into the dependency.
3. A user follows the Skill instructions and installs the mutable package through Homebrew or pip install ..
4. The malicious package executes with the installing user's privileges.
5. The user grants Automation access to Notes.app as instructed by the Skill.
6. The compromised CLI can attempt to read, modify, export, or delete notes accessible to that user ...[truncated 592 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to a specific audited release or immutable commit rather than tracking a mutable repository state.
2. Provide the exact canonical repository and release URL for manual installation.
3. Publish and verify a cryptographic checksum or signature for the selected release artifact before installation.
4. For Homebrew installation, pin a reviewed formula version or commit and document how users can verify the formula and downloaded artifact.
5. Replace the ambiguous pip install . guidance with an explicit, version-pinned procedure from a trusted source.
6. Review dependency changes before updating the pinned version.
7. Explain that Notes Automation access is security-sensitive and should only be granted after the installed binary's provenance and integrity have been verified.
8. Encourage users to revoke Automation permission when the integration is no longer needed.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill instructs users to delete notes via memo notes -d but does not warn that the action is destructive or may permanently remove user data. In an agent-driven workflow, a model could invoke this capability on ambiguous user intent, increasing the risk of accidental data loss in a sensitive personal notes store.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The skill tells users to grant Automation access to Notes.app without explaining that this gives terminal tooling system-level access to the user's notes content. Because Apple Notes often contains sensitive personal or business information, omitting a privacy warning can lead users to authorize access without understanding the data exposure implications.

Content

No source excerpt is available for this finding.