T07 · Tool Hijacking and Spoofing
Warning
- Location
cli.js:9- Finding
PATH-Based osascript Executable Hijacking
- Content
View full analysis
- Remediation
View remediation
Security audit
Mac Notes Agent
Security checks for vulnerabilities and agentic risk
Overview
This skill clearly works with Apple Notes, but its update and delete commands can alter or remove notes without confirmation and may affect the wrong note when titles are duplicated.
Review this skill before installing if your Notes contain important or sensitive information. Use a specific folder, avoid duplicate note titles, read a note before updating or deleting it, and keep backups because the CLI has no built-in confirmation or dry-run for destructive changes.
Vulnerability Patterns
- Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
cli.js:287- Finding
Ambiguous Note Selection Can Read, Modify, or Delete the Wrong Note
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (5)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This markdown file describes a delete command for Apple Notes, which can affect user data, but it provides no warning that the operation removes notes or may be irreversible. Under the markdown-specific warning criteria, destructive behaviors that impact user data should be disclosed clearly.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The update command is documented as replacing the entire note body, but the skill provides no warning about irreversible overwrites or recommendation to read/backup the existing content first. In an agent workflow, a mistaken target selection or malformed body can silently destroy user data, and the identification model's title-based matching increases that risk when duplicate titles exist.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill exposes a delete operation for Apple Notes without documenting any confirmation, dry-run, trash behavior, or recovery guidance. In an agent-driven context, that increases the chance of accidental or automated destructive actions against user data, especially because the skill can target notes by folder/title where ambiguity may exist.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The delete command permanently removes a note based solely on CLI arguments, with no confirmation prompt, dry-run mode, or safety interlock. In an agent/tooling context, this increases the chance of accidental or unauthorized destructive actions if the agent is prompted incorrectly, operates on ambiguous note identifiers, or is exposed to prompt injection through higher-level orchestration.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
The add, update, and append flows create or overwrite note contents in Apple Notes, which are file/data-modifying operations. In this file there is no confirmation, warning message, or explanatory comment disclosing that user data in Notes will be created or altered.
- Content
Static analysis
No suspicious patterns detected.