This report does not block or authorize the manifest or ZIP.
I confirmed the core external-command risk because the skill directs agents to execute AppleScript with osascript and includes shell execution examples. The Safari URL, keylogger, screenshot-upload, and Python HTTP alerts are false positives for malicious networking, keylogging, uploads, or HTTP use, but local screenshot and keystroke automation remain privacy-sensitive. No evidence found of prompt injection text in the reviewed skill files.
Report position
Historical report
Open audit history before using this report to install.
Audit attestation
Not attestable
The required immutable binding is incomplete.
Human verification
Not verified
No human verification is recorded for this report.
Coverage
9 Files scanned · 2,301 Lines analyzed
12 items shown for review
Limitations
This report does not claim runtime or sandbox execution and does not prove the absence of side effects.
01
Evidence chain
Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.
This skill enables control of macOS applications and system functions through AppleScript execution
The skill explicitly states that it controls macOS through AppleScript execution via the osascript command. That is legitimate for this skill, but it is real local command execution under the user's permissions.
The cited code block includes an osascript command that executes AppleScript from the shell. That command can affect local apps and data, so the external-command finding is confirmed.
The cited multi-line shell block invokes osascript through a heredoc. This is functional command execution, even though it is presented as documentation.
The cited quick reference executes osascript to display a notification. It is a benign example, but it still confirms local external command execution.
The cited block activates an application through osascript. Launching or focusing local apps is a real automation side effect, so the external-command risk is confirmed.
The cited clipboard examples run osascript from the shell to read and set clipboard content. Clipboard access is privacy-sensitive, so the external-command finding is confirmed.
03
Risk findings
Confirmed security concerns are separated from items that still need review.
The system reference includes examples that capture the screen and send keystrokes to the active session. These actions can reveal private content or manipulate apps without careful user confirmation.
The cited examples directly show screencapture commands and System Events keystroke commands. They are not upload or keylogging code, but they are sensitive local automation capabilities.
The skill advertises reading Mail, Calendar, Finder, clipboard, and system data through AppleScript. These functions can expose private local content if prompts are overbroad or malicious.
The cited sections explicitly list Mail, Calendar, Finder, and system-control capabilities. The risk is contextual rather than hidden because the skill also states privacy guidance.
The self-improvement protocol tells the assistant to edit reference files and update the skill version after failures. This can mutate installed skill content during normal use and reduce auditability.
The cited protocol directly instructs use of the Edit tool on skill reference files and version metadata. It appears intended for maintenance, but it still changes reviewed content after installation.
The system reference includes restart, shutdown, sleep, and logout examples. These operations can interrupt user work if executed without clear confirmation.
The cited lines contain explicit AppleScript examples for restart, shutdown, sleep, and logout. macOS may prompt for some actions, but the examples remain disruptive automation patterns.
04
Remediation
Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.
FIX-001
High
Screenshot and keystroke examples are privacy-sensitive even though they are not upload or keylogging code.
Label screen capture and keyboard simulation examples as high-risk and require visible user approval before execution.
FIX-002
Medium
External command execution through osascript is central to the skill.
Require explicit user confirmation before running generated AppleScript, especially when the script uses do shell script or changes system state.
FIX-003
Medium
The skill can access private Mail, Calendar, Finder, clipboard, and browser data.
Add a consent checklist for each sensitive app and limit displayed results to the minimum data requested by the user.
FIX-004
Medium
The self-improvement protocol asks the assistant to edit installed skill documentation.
Move documentation updates to a maintainer workflow and avoid modifying skill files during ordinary automation use.
05
Expert evidence
Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.
Artifact subject
Marketplace commit
Unavailable
Content hash
Unavailable
Tree hash
Unavailable
Skill path
Unavailable
Audit payload hash
Unavailable
Analysis metadata
Audit model: codex
Analysis state: Complete
Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.