macOS Contacts

Read, search, and safely create contacts in macOS Contacts (Address Book). Use when the user asks to inspect the native macOS contacts database, search conta...

This skill appears coherent and implements local read/write workflows for macOS Contacts. Before installing or running it: (1) review and be comfortable with backups written to ~/.openclaw/state/macos-contacts (these contain contact data and should be protected or cleaned if needed); (2) expect to grant macOS Contacts automation/Contacts.framework permission when running Swift/AppleScript writes; (3) inspect any commands you run under contacts_txn.sh since it executes arbitrary local commands and will restore backups on failure; (4) confirm you have swift/python installed on the target mac; and (5) note there are some minor code quality issues (e.g., a bug in a Merge script's 'originals' construction and a truncated Swift file in the distribution preview) — consider testing in a safe environment or reviewing those files before using in production.

Type: OpenClaw Skill Name: openclaw-macos-contacts Version: 0.1.1 The skill provides extensive access to the macOS Contacts database and includes a transaction wrapper (`contacts_txn.sh`) for shell command execution. While no malicious intent is evident, the scripts exhibit several high-risk patterns and vulnerabilities, specifically unsafe string interpolation of shell variables into Python heredocs in `scripts/contacts_txn.sh` and `scripts/contacts_dedupe.sh`, which could lead to code injection if command outputs contain unexpected characters. Additionally, the skill's core functionality requires broad permissions to read and modify sensitive user data in `~/Library/Application Support/AddressBook/`, which is a significant attack surface.