← 返回 Skills 市场

Apple Notes (AppleScript)

Name: Apple Notes (AppleScript)
Author: shad0wca7

作者 shad0wca7 · GitHub ↗ · v1.1.0

darwin ⚠ suspicious

1082

总下载

当前安装

版本数

在 OpenClaw 中安装

/install apple-notes-applescript

功能描述

Apple Notes.app integration for macOS. List folders, read, create, search, edit, and delete notes via AppleScript.

使用说明 (SKILL.md)

Apple Notes

Interact with Notes.app via AppleScript. Run scripts from: cd {baseDir}

Commands

Command	Usage
List folders	`scripts/notes-folders.sh [--tree] [--counts]`
List notes	`scripts/notes-list.sh [folder] [limit]`
Read note	`scripts/notes-read.sh \x3Cname-or-id> [folder]`
Create note	`scripts/notes-create.sh \x3Cfolder> \x3Ctitle> [body]`
Search notes	`scripts/notes-search.sh \x3Cquery> [folder] [limit] [--title-only]`
Edit note	`scripts/notes-edit.sh \x3Cname-or-id> \x3Cnew-body> [folder]`
Delete note	`scripts/notes-delete.sh \x3Cname> \x3Cfolder>` ⚠️ folder required

Folder Paths

All commands support subfolder paths with / separator:

scripts/notes-list.sh "Scanned/Medical & Health" 10
scripts/notes-read.sh "blood test" "Scanned/Medical & Health"
scripts/notes-create.sh "Property/416 Garfield" "Inspection notes" "Roof looks good"

Folder Tree Structure

This collection has 4000+ notes. Key structure:

Scanned — parent folder with many subfolders (Medical & Health, Receipts, etc.)
Fetish — parent with subfolders (AW, Bimbo, Events, etc.)
Hobbies — parent with subfolders (3d printing, Homelab, etc.)
Property — subfolders per address

Use --tree --counts to see the full hierarchy.

Folder Listing

scripts/notes-folders.sh                  # Flat list
scripts/notes-folders.sh --counts         # With note counts
scripts/notes-folders.sh --tree --counts  # Full hierarchy with counts

Listing Notes

scripts/notes-list.sh "Notes" 10                      # Specific folder
scripts/notes-list.sh "Scanned/Receipts" 5             # Subfolder
scripts/notes-list.sh "" 10                             # All folders (shows folder name per note)

Reading Notes

scripts/notes-read.sh "blood test" "Scanned/Medical & Health"   # By name (partial match)
scripts/notes-read.sh "x-coredata://…/ICNote/p12345"            # By ID (direct lookup, fast)

Output: Title, Folder, Modified date, ID, then body text.

Searching

Title search first (fast), body search fallback (slower):

scripts/notes-search.sh "tax" "" 10                    # All folders
scripts/notes-search.sh "receipt" "Scanned/Receipts" 5  # Specific folder
scripts/notes-search.sh "keyword" "" 10 --title-only    # Skip body search

Output: ID | Date | Folder | Title

Creating Notes

scripts/notes-create.sh "Notes" "My Title" "Body text here"   # With body
scripts/notes-create.sh "Notes" "Empty Note"                    # Title only

Returns the created note's ID.

Editing Notes

scripts/notes-edit.sh "My Note" "New body content" "Notes"              # By name
scripts/notes-edit.sh "x-coredata://…/ICNote/p12345" "New body"         # By ID

Deleting Notes

scripts/notes-delete.sh "Old Note" "Notes"                    # Folder required
scripts/notes-delete.sh "receipt" "Scanned/Receipts"

⚠️ Folder argument is required for safety — prevents accidental matches across 4000+ notes.

Performance Tips

Situation	Tip
Listing/searching all notes	Always specify a folder — iterating 4000+ notes is slow
Reading a known note	Use the ID from a previous list/search — instant lookup
Searching large folders	Use `--title-only` if body search isn't needed
Finding the right folder	Use `--tree --counts` first to see hierarchy

Errors

Error	Cause
`Error: Can't get folder`	Folder name doesn't exist or wrong path
`No note matching…`	No partial match found in scope
Empty body text	Scanned/image-only notes have no extractable text

Technical Notes

Partial name matching for read/edit/delete (first match wins)
Multiline body supported via temp files
Folder names are case-sensitive
All user inputs escaped for AppleScript safety (quotes, backslashes)
number of used instead of count of (AppleScript reserved word)

安全使用建议

This skill will read, create, edit and delete notes and can extract attachments from your local Notes database (it looks under ~/Library/Group Containers/group.com.apple.notes/). That behavior is expected for a Notes integration, but these are sensitive actions: - Expect macOS automation/Notes permission prompts when running these scripts. Granting those permissions gives the scripts access to your Notes data. - Deleting notes requires explicitly passing a folder (the script enforces this), but review delete usage carefully and consider backing up important notes first. - Attachment extraction copies files into /tmp/notes-export/ — verify and remove exported files when finished. - The scripts are local shell code; if you want extra safety, review or run them in a sandboxed account, or inspect/modify them before use. Minor implementation notes (non-malicious): some filename handling uses unquoted expansions (e.g., listing preview files) which could break on unusual filenames; this is an implementation robustness issue, not evidence of exfiltration. If you need higher assurance, review the scripts line-by-line or run them in a non-production environment first.

功能分析

Type: OpenClaw Skill Name: apple-notes-applescript Version: 1.1.0 The skill bundle contains a critical shell injection vulnerability in `scripts/notes-search.sh`. When the `--spotlight` flag is used, the user-provided `$QUERY` is directly interpolated into an `mdfind` command without proper sanitization, allowing for arbitrary command execution. While other scripts demonstrate good input sanitization for AppleScript, this specific flaw poses a significant risk. There is no evidence of intentional malicious behavior such as data exfiltration to external endpoints or persistence mechanisms.

能力评估

✓ Purpose & Capability

Name/description (Apple Notes integration) match the included scripts and behavior. The scripts use osascript to list, read, create, edit, search and delete notes and to extract attachments from the Notes group container; all of these are legitimate needs for the stated purpose.

✓ Instruction Scope

SKILL.md instructs running the included scripts and documents their behavior. The scripts read and write only local Notes.app data and temp files (/tmp, ~/Library/Group Containers/group.com.apple.notes/...), which is necessary for attachment extraction and note manipulation. They do not transmit data to remote endpoints. Note: some Spotlight (mdfind) usage and file-copy operations operate on local disk and may require macOS automation or Filesystem permissions; the scripts will access sensitive user note content and attachments (expected for this skill).

✓ Install Mechanism

No install spec — instruction-only with included shell scripts. Nothing is downloaded or extracted from external URLs, so there's no install-time code-fetch risk.

✓ Credentials

The skill requires no environment variables, credentials, or external tokens. It does access local Notes data and account directories in ~/Library/Group Containers which is proportional to attachment extraction and note access.

✓ Persistence & Privilege

always:false and normal model invocation settings. The skill does not request persistent system-wide changes or modify other skills' configurations.

如何使用

确保已安装 OpenClaw（本地或 Docker 部署）
在对话框中输入安装命令：/install apple-notes-applescript
安装完成后，直接呼叫该 Skill 的名称或使用 /apple-notes-applescript 触发
根据 Skill 的参数说明提供必要输入，即可获得结构化输出

版本历史

v1.1.0

v1.1.0: PDF/image attachment extraction, Spotlight OCR search (--spotlight), notes-export-pdf.sh convenience script, shared folder resolver handles / in folder names, container lookup error handling, UUID auto-detection fix.

v1.0.0

Complete rewrite using native AppleScript instead of memo CLI. Subfolder paths, CRUD, smart folder name handling (Finance / Tax), ID-based lookups, search with title+body fallback.

元数据

Slug apple-notes-applescript

版本 1.1.0

许可证 —

累计安装 3

当前安装数 3

历史版本数 2

常见问题