Trust Assessment
apple-contacts received a trust score of 73/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.
SkillShield's automated analysis identified 1 finding: 1 critical, 0 high, 0 medium, and 0 low severity. Key findings include Potential AppleScript Command Injection via osascript.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 14, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings1
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| CRITICAL | Potential AppleScript Command Injection via osascript The skill documentation demonstrates the use of `osascript` to interact with the macOS Contacts application. `osascript` executes arbitrary AppleScript code provided as a string. If an AI agent constructs these `osascript` commands by directly interpolating untrusted user input (e.g., contact names, phone numbers) into the AppleScript string without proper sanitization, an attacker could inject malicious AppleScript. This could allow for arbitrary code execution on the host system, potentially via the `do shell script` command within AppleScript, leading to data exfiltration, system modification, or further compromise. Implement robust sanitization and escaping of all user-provided input before it is embedded into `osascript` commands. Specifically, ensure that double quotes (`"`) and other AppleScript string delimiters are properly escaped or handled to prevent injection. The skill documentation should include explicit warnings and examples of safe input handling, such as using `quoted form of` in shell scripts or careful string replacement in the agent's code. | LLM | SKILL.md:10 |
Scan History
Embed Code
[](https://skillshield.io/report/f21883429c6467cb)
Powered by SkillShield