The Agent Skills Directory

[COMMAND_EXECUTION] (HIGH): The bash script scripts/fetch-notes.sh performs unsafe string interpolation into AppleScript commands executed via osascript -e. Specifically, variables $ARG, $NOTE_NAME, and $COUNT are directly embedded into the AppleScript source. An attacker can use double quotes to break out of the AppleScript string and use the do shell script command to execute arbitrary shell commands with the user's permissions.
[REMOTE_CODE_EXECUTION] (HIGH): The AppleScript injection vulnerability allows for arbitrary code execution on the host machine. If an agent is tricked into calling this script with a malicious argument (e.g., via a malicious configuration in settings.json or by searching for a specially crafted string), it leads to full system compromise.
[DATA_EXFILTRATION] (MEDIUM): The skill is designed to read private data from the macOS Notes app. While this is the intended functionality, the lack of input validation and the possibility of command injection create a high risk of unauthorized data access and exfiltration.
[PROMPT_INJECTION] (LOW): The skill is vulnerable to indirect prompt injection because it ingests untrusted data from external sources (Notes app and local markdown files) and processes it with high-capability tools (the LLM and shell scripts).
Ingestion points: scripts/fetch-notes.sh (reading from macOS Notes), X_SOURCE_FILE (reading from local markdown files).
Boundary markers: None present. The skill does not use delimiters or instructions to ignore embedded commands in the source data.
Capability inventory: Subprocess execution (via fetch-notes.sh), file system write access (saving drafts to X_DRAFTS_FILE).
Sanitization: None. The content of the notes is stripped of HTML tags but otherwise passed directly to the model and scripts.

x-writing