NoteStore Lab Case Review

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 5:24 AM UTC
• Version: 1.0.2

Overview

This skill is a disclosed local Apple Notes case-review helper, but users should treat its external PyPI package install as a supply-chain trust decision.

Install only if you trust the NoteStore Lab PyPI package and run it against copied case data, not the live Notes store. Prefer a virtual environment or sandbox, avoid admin/root privileges, and limit the MCP process to the specific case directory you intend to review.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: references/install-and-mcp.md:10

Finding

Unverified Third-Party Package Installation and Execution

Content

View full analysis

``` ```json { "mcpServers": { "notestorelab": { "command": "uvx", "args": [ "--from", "apple-notes-forensics==0.1.0.post1", "notes-recovery-mcp", "--case-dir", "./output/Notes_Forensics_" ] } } } ``` ### Technical Analysis The skill instructs users and MCP hosts to download and execute the external PyPI package `apple-notes-forensics==0.1.0.post1`. The package implementation and its transitive dependencies are not included in the audited project, so their behavior cannot be verified from this artifact. Pinning the package version reduces exposure to unexpected future upgrades, but it does not establish artifact integrity. The instructions provide no cryptographic hashes, signed provenance, verified lock file, or reproducible dependency manifest. Both `pip install` and `uvx --from` therefore trust content delivered by the external package registry. The MCP command is especially sensitive because the resulting process is given a path to an Apple Notes forensic case directory. Any malicious code in the package, its build process, or a transitive dependency would execute with the permissions of the user or MCP host and could interact with the supplied evidence directory and other resources available to that account. This finding identifies an unaudited supply-chain execution boundary. It does not establish that the named PyPI package is ...[truncated 1587 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 84)May include surrounding context.

md

The canonical skill text still lives at:

- `skills/notestorelab-case-review/SKILL.md`

This folder is a public-facing derived packet. If the canonical skill changes,
copy the updated `SKILL.md` here before publishing.