Apple Notes Snapshot Control-Room

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:21 AM UTC
• Version: 1.0.2

Overview

The skill is mostly coherent, but its normal setup path tells an agent to run unverified code from GitHub and install a recurring local job, so it needs human review before use.

Review the referenced apple-notes-snapshot repository yourself before running notesctl. Prefer a specific audited commit with checksum or signature verification, run one-time proof commands first, and only enable the recurring 30-minute install after you understand how to inspect and remove the scheduled job.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: references/install-and-attach.md:14
• Finding: Unverified Remote Payload Retrieval and Execution## Vulnerability Details **File Location**: `references/install-and-attach.md:14-18, 27-32`; duplicated in `references/usage-and-proof.md:13-17, 21-27` **Vulnerability Type**: Remote retrieval and execution of externally controlled code **Risk Level**: High **Vulnerable Code**: ```bash git clone --depth 1 --branch v0.1.12 \ https://github.com/xiaojiou176-open/apple-notes-snapshot.git cd apple-notes-snapshot ``` The retrieved program is subsequently executed: ```bash ./notesctl run --no-status ./notesctl install --minutes 30 --load ./notesctl verify ./notesctl doctor ``` The documentation also permits retrieving the current default branch: > If you want current-main behavior instead of the last tagged proof baseline, > clone without `--branch v0.1.12`. ### Technical Analysis The Skill instructs the agent to clone a separate GitHub repository and directly execute its `notesctl` program. The downloaded implementation is not included in the audited package, so its behavior cannot be reviewed from this artifact. The repository is selected using a Git tag rather than an immutable commit hash, verified release signature, or published checksum. Git tags can be moved or replaced unless external verification is enforced. The alternative recommendation to clone the current default branch is even less stable because its effective payload can change after this Skill has been reviewed. This behavior best matches remote payload retrieval and execution: the reviewed Skill provides the retrieval and execution channel, while the effective code payload remains externally controlled. ### Attack Path 1. An attacker compromises the referenced GitHub account or repository, moves the `v0.1.12` tag, or introduces malicious code into the default branch. 2. An agent follows the Skill instructions and clones the externally controlled repository. 3. The agent executes `./notesctl run --no-status`. 4. The agent executes `. ...[truncated 746 chars]
• Remediation: ## Remediation Suggestions 1. Pin the dependency to a full, immutable Git commit hash instead of a mutable tag or default branch. 2. Publish and verify a cryptographic release signature or SHA-256 checksum before executing `notesctl`. 3. Remove the recommendation to retrieve current default-branch behavior for routine installation. 4. Include the reviewed `notesctl` implementation in the distributed artifact, or provide a separately versioned and verifiable package. 5. Present retrieved source for review and require explicit user approval before the first execution. 6. Separate download, verification, execution, and persistence installation into distinct steps. 7. Document the files, subprocesses, network behavior, local data access, and permissions required by `notesctl`.

T06 · System Persistence

Error

• Location: references/install-and-attach.md:27
• Finding: Recurring System Persistence Installed During the Proof Flow## Vulnerability Details **File Location**: `references/install-and-attach.md:27-32`; duplicated in `references/usage-and-proof.md:21-27` and referenced by `SKILL.md:39-43` **Vulnerability Type**: Installation and loading of a recurring scheduled process **Risk Level**: High **Vulnerable Code**: ```bash ./notesctl run --no-status ./notesctl install --minutes 30 --load ./notesctl verify ./notesctl doctor ``` The same persistence command is included in the documented first-success path: ```bash ./notesctl run --no-status ./notesctl install --minutes 30 --load ./notesctl verify ./notesctl doctor ./notesctl status --full ``` ### Technical Analysis The command `./notesctl install --minutes 30 --load` explicitly requests installation and immediate loading of a process that runs at 30-minute intervals. This changes persistent system or user configuration and causes execution to continue after the initial Skill invocation. Persistence is presented as part of the minimum operator proof and first-success flow rather than as a separate, security-sensitive, opt-in operation. The audited package does not contain the `notesctl` implementation, so the exact scheduler mechanism, generated files, command arguments, environment, inherited permissions, and cleanup behavior cannot be verified. The documentation also provides no corresponding uninstall procedure. Consequently, an agent following the normal proof path may create a cross-session scheduled task without sufficient information to inspect or remove it. ### Attack Path 1. The agent retrieves the external `notesctl` implementation. 2. The agent follows the minimum proof path. 3. `./notesctl install --minutes 30 --load` creates and loads a recurring job. 4. The installed job survives the initiating process and executes approximately every 30 minutes. 5. If `notesctl`, its checkout, or its invoked components are malicious or later replaced, attacker-controlled ...[truncated 702 chars]
• Remediation: ## Remediation Suggestions 1. Remove `install --minutes 30 --load` from the minimum proof and first-success workflows. 2. Make recurring scheduling a separate, explicit opt-in operation performed only after local one-time verification succeeds. 3. Explain that the command creates persistent recurring execution and obtain informed user confirmation before running it. 4. Document the exact scheduler or service mechanism, generated file paths, executable path, environment, permissions, and trigger interval. 5. Provide and test an uninstall command that unloads the job and removes all generated persistent configuration. 6. Pin the scheduled executable to an integrity-verified, non-user-writable location. 7. Apply least privilege and ensure the recurring process cannot access data unrelated to Apple Notes snapshot operation. 8. Use one-time foreground execution for MCP attachment verification whenever persistence is not necessary.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The trigger list includes generic phrases like "apple notes snapshot", "ai diagnose", "local web api", and "attach proof" without constraints or exclusion conditions. These phrases could easily appear in ordinary discussion about the project and may cause unintended invocation because the manifest does not define when the skill should or should not activate.

Scope Creep

Low

• Category: Excessive Agency

Content

- Repo-owned starter packs and local marketplaces are public-ready wiring kits.
- They are not the same thing as official public directory listing.
- A tagged `v0.1.12` named-host attach-proof trail on one machine does not become a universal
  proof for every host build or every machine.

## Example prompts

• Confidence: 65% confidence
• Finding: Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Static analysis

No suspicious patterns detected.