Live survey304 models · 14 providers · 22,792 auditsAudited grill-with-docs · SAFE →What changedHow we verifyllms.txt

Agent skill · Audited from source

Apple Shortcuts Integration

skill · claude-office-skills/skillsMIT licenceAudited 26 Oct 2026 · source 79d91524ef4c

★ 541pushed 268 days agoversion 1.0.0
✕BLOCKGrade D · 69/100 · 11 findings · 79d9152
541repo stars · whole claude-office-skills/skills

Is it safe? No — BLOCK, grade D (69/100). We read this skill's source at commit 79d91524ef4c and observed filesystem and network access and no hard-coded secrets. The audit raised 11 findings, 1 critical or high. What it does: A clear, concise description of what this skill does (1-2 sentences). Focus on the VALUE it provides to the user.

Ask an AI about this pageGChatGPTCClaudePPerplexityGeGeminiXGrok
More
Cite

Cite this page

ModelsAtlas. “Apple Shortcuts Integration (claude-office-skills/skills)”. Retrieved 26 Oct 2026. https://modelsatlas.com/skills/claude-office-skills/apple-shortcuts-integration

Blocked. The page stays public so you can check this skill if someone recommended it to you. The audit found 1 critical or high finding, starting with “Prompt injection” in image-generation/SKILL.md:65. Do not install it without reading them.

Trust audit

Audit 0.4.1 · source read 26 Oct 2026

Trust score69/100✕BLOCK D
0 critical1 high2 medium3 low5 info

BLOCK means the audit found something that could harm you or your machine. Grade D is shared by 721 of 17,602 audited skills.

What the source does

  • FilesystemDeclared2 observations
  • NetworkDeclared1 observation
  • ShellNone observedNo commands run in the source
  • DependenciesNot pinnedSome versions float
  • SecretsNone foundNo keys in source

Five audit layers

LayerWhat we checkResultFindings
L0 ProvenanceRepo owner, licence, archive status, activityPASS0
L1 Static sourceSecrets, path traversal, supply chain, hidden codeWARN4
L2 InstructionsPrompt injection, authority framing, hidden directivesFAIL7
L3 InventoryThe files and declarations match the sourcePASS0
L4 SandboxRun in isolation and watch behaviourSKIPPED why0

Gates applied: instruction override, no behavioural pass.

Findings (11)

HIGHPrompt injectionprompt.override · image-generation/SKILL.md:65
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
- Bypass content policies of AI tools
Why
asks the agent to drop prior instructions or safety
Fix
remove the instruction
MEDIUMNetwork egressnet.raw_ip · suspicious-email/SKILL.md:100
F-04 Network egressCWE-200 · CWE-319Layer L1
- [ ] **IP address URLs**: http://192.168.1.1/login
Why
No further detail recorded for this rule.
Fix
—
MEDIUMPrompt injectionprompt.hidden_style · html-to-ppt/SKILL.md:302
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
<div style="color: white;">
Why
No further detail recorded for this rule.
Fix
—
LOWFilesystem / pathfs.traversal · mcp-servers/office-mcp/dist/knowledge/loader.js:51
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
const KNOWLEDGE_BASE_PATH = path.join(__dirname, "../../knowledge");
Why
No further detail recorded for this rule.
Fix
—
LOWFilesystem / pathfs.traversal · mcp-servers/office-mcp/src/knowledge/loader.ts:78
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
const KNOWLEDGE_BASE_PATH = path.join(__dirname, "../../knowledge");
Why
No further detail recorded for this rule.
Fix
—
LOWSupply chainsupply.unpinned · mcp-servers/office-mcp/package.json
F-08 Supply chainCWE-829 · CWE-1357Layer L1
@modelcontextprotocol/sdk, docx, docxtemplater, mammoth, marked, pandoc, pdf-lib, pdf-parse
Why
21 dependency range(s) float
Fix
pin exact versions or ship a lockfile
INFOSupply chainprompt.pipe_to_shell · README.md:79
F-08 Supply chainCWE-829 · CWE-1357Layer L2
curl -fsSL https://molt.bot/install | bash -s -- --agent legal-specialist
Why
No further detail recorded for this rule.
Fix
—
INFOSupply chainprompt.pipe_to_shell · README.md:192
F-08 Supply chainCWE-829 · CWE-1357Layer L2
curl -fsSL https://raw.githubusercontent.com/claude-office-skills/skills/main/install.sh | bash
Why
No further detail recorded for this rule.
Fix
—
INFOSupply chainprompt.pipe_to_shell · README.md:195
F-08 Supply chainCWE-829 · CWE-1357Layer L2
curl -fsSL https://raw.githubusercontent.com/claude-office-skills/skills/main/install.sh | bash -s -- --category legal
Why
No further detail recorded for this rule.
Fix
—
INFOSupply chainprompt.pipe_to_shell · README.md:196
F-08 Supply chainCWE-829 · CWE-1357Layer L2
curl -fsSL https://raw.githubusercontent.com/claude-office-skills/skills/main/install.sh | bash -s -- --category pdf
Why
No further detail recorded for this rule.
Fix
—
INFOSupply chainprompt.pipe_to_shell · README.md:197
F-08 Supply chainCWE-829 · CWE-1357Layer L2
curl -fsSL https://raw.githubusercontent.com/claude-office-skills/skills/main/install.sh | bash -s -- --category workflow
Why
No further detail recorded for this rule.
Fix
—

Audit 0.4.1 · source sha 79d91524ef4c · 26 Oct 2026Report an issue or request a re-scan

Provenance

Who published it, and what the verdict is pinned to

  • Publisherclaude-office-skills GitHub organizationOwner of the repository this skill is read from
  • Source folderclaude-office-skills/skillsThe exact folder we audited
  • LicenceMITAs the repository states it
  • Commit pinned for this verdict79d91524ef4cA new audit runs when the source changes
  • Repository statusNot archivedLast push 268 days ago
  • Sandboxed runNot runSkills are read, not executed; layer L4 is skipped

What it tells the agent

Full source on GitHub ↗

Its description: A clear, concise description of what this skill does (1-2 sentences). Focus on the VALUE it provides to the user.

---
# ═══════════════════════════════════════════════════════════════════════════════
# CLAUDE OFFICE SKILL - Enhanced Metadata Template v2.0
# ═══════════════════════════════════════════════════════════════════════════════
# 
# This template defines a Skill as a "Scenario-based Solution Guide"
# Skills tell AI "WHAT" to do and "HOW" to do it
# MCP tools provide "WITH WHAT" to accomplish tasks
#
# ═══════════════════════════════════════════════════════════════════════════════

# ─────────────────────────────────────────────────────────────────────────────────
# BASIC INFORMATION (Required)
# ─────────────────────────────────────────────────────────────────────────────────
name: skill-name
description: >
  A clear, concise description of what this skill does (1-2 sentences).
  Focus on the VALUE it provides to the user.
version: 1.0.0
author: claude-office-skills
license: MIT

# ─────────────────────────────────────────────────────────────────────────────────
# CATEGORIZATION (Required)
# ─────────────────────────────────────────────────────────────────────────────────
category: legal  # Primary category: legal | hr | finance | sales | marketing | productivity | pdf | document | spreadsheet | presentation | workflow
tags:
  - contract      # Domain tags
  - review        # Action tags
  - risk-analysis # Feature tags
department: Legal  # Target department/user group

# ─────────────────────────────────────────────────────────────────────────────────
# AI MODEL COMPATIBILITY (Optional)
# ─────────────────────────────────────────────────────────────────────────────────
models:
  recommended:
    - claude-sonnet-4
    - claude-opus-4
  compatible:
    - claude-3-5-sonnet
    - gpt-4
    - gpt-4o

# ─────────────────────────────────────────────────────────────────────────────────
# MCP TOOLS INTEGRATION (Required for tool-using skills)
# ─────────────────────────────────────────────────────────────────────────────────
# Skills are "solution guides" - MCP provides the actual tools
mcp:
  server: office-mcp  # Which MCP server provides the tools
  tools:              # Tools this skill uses (from office-mcp)
    - extract_text_from_pdf
    - extract_text_from_docx
    - analyze_document_structure
  optional_tools:     # Nice-to-have tools
    - create_docx
    - docx_to_pdf

# ─────────────────────────────────────────────────────────────────────────────────
# EXTERNAL DATA SOURCES (Optional - for data-driven skills)
# ─────────────────────────────────────────────────────────────────────────────────
# data_sources:
#   - name: Alpha Vantage
#     url: https://www.alphavantage.co/
#     type: api
#     api_key_required: true
#     rate_limit: "5 requests/minute (free tier)"
#   - name: Yahoo Finance
#     url: https://finance.yahoo.com/
#     type: web
#     api_key_required: false

# ─────────────────────────────────────────────────────────────────────────────────
# INPUT/OUTPUT SPECIFICATION (Recommended)
# ─────────────────────────────────────────────────────────────────────────────────
input:
  required:
    - type: file
      formats: [pdf, docx]
      description: The contract document to review
    - type: text
      name: party_role
      description: Which party you are (employee, contractor, buyer, etc.)
  optional:
    - type: text
      name: jurisdiction
      description: Legal jurisdiction (US, EU, China, etc.)
    - type: text
      name: concerns
      description: Specific areas of concern

output:
  primary:
    type: report
    format: markdown
    sections:
      - risk_summary
      - detailed_findings
      - recommendations
  artifacts:
    - type: file
      name: analysis_report.md
      description: Detailed analysis report

# ─────────────────────────────────────────────────────────────────────────────────
# SKILL CAPABILITIES (For discovery/matching)
# ─────────────────────────────────────────────────────────────────────────────────
capabilities:
  - contract_analysis
  - risk_identification
  - legal_compliance_check
  - negotiation_recommendations

# ─────────────────────────────────────────────────────────────────────────────────
# LANGUAGE SUPPORT
# ─────────────────────────────────────────────────────────────────────────────────
languages:
  - en  # English
  - zh  # Chinese

# ─────────────────────────────────────────────────────────────────────────────────
# RELATED SKILLS (For navigation/discovery)
# ─────────────────────────────────────────────────────────────────────────────────
related_skills:
  - nda-generator
  - offer-letter
  - proposal-writer
---

# Skill Name

## Overview

[Clear explanation of what this skill does and when to use it]

**What I can do:**
- [Capability 1]
- [Capability 2]
- [Capability 3]

**What I cannot do:**
- [Limitation 1]
- [Limitation 2]

---

## How to Use Me

### Step 1: [First Step]
[Instructions]

### Step 2: [Second Step]
[Instructions]

### Step 3: [Third Step]
[Instructions]

---

## Domain Knowledge

[This is where the real value lives - embedded expertise, patterns, rules, best practices]

### [Knowledge Area 1]
[Details]

### [Knowledge Area 2]
[Details]

---

## Output Format

[Define the structure of outputs this skill produces]

```
## [Output Title]

### Section 1
[Content pattern]

### Section 2
[Content pattern]
```

---

## Examples

### Example 1: [Scenario]
**User**: [Example input]
**AI**: [Example output]

### Example 2: [Scenario]
**User**: [Example input]
**AI**: [Example output]

---

## Tips for Better Results

1. [Tip 1]
2. [Tip 2]
3. [Tip 3]

---

## Limitations

- [Limitation 1]
- [Limitation 2]
- [Limitation 3]

---

*Built by the Claude Office Skills community. Contributions welcome!*

Excerpt, first 5,679 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.

Install

Pinned to the audited commit 79d9152

git clone https://github.com/YOUR_USERNAME/skills.git
pip install pdf2docx markitdown python-docx openpyxl
npm install -g @marp-team/marp-cli
pip install python-docx openpyxl python-pptx reportlab jinja2
npm install -g @accordproject/cicero-cli
pip install rendercv

Commands as the repository documents them: shown, never run by us. Our verdict covers commit 79d91524ef4c only.

Works in which agents?

What its own text says, not a test

AgentStatusMore
Claude CodeMentioned in its text, not testedSkills for Claude Code · About Claude Code
Claude DesktopMentioned in its text, not testedSkills for Claude Desktop · About Claude Desktop
CursorMentioned in its text, not testedSkills for Cursor · About Cursor
OpenClawMentioned in its text, not testedSkills for OpenClaw · About OpenClaw
“Mentioned” means the skill’s text names the agent. We have not run it there.

Audit history

Every audit, every source change

  1. ✕BLOCK D 69 / 100

    first audit · source 79d91524ef4c

Similar skills

Questions about Apple Shortcuts Integration

What does the Apple Shortcuts Integration skill do?
A curated collection of practical Claude Skills for real-world office tasks
Is Apple Shortcuts Integration safe to install?
No — not without reading the findings first. The audit graded it D (69/100) and found 1 critical or high issue in the source. Each one is listed on this page with the file and line it is on.
What can Apple Shortcuts Integration access on my machine?
The audit observed that it reaches the network and reads or writes files. Each of those is consistent with what it says it does. Secrets in the source: none found.
Which assistants does Apple Shortcuts Integration work with?
Its documentation mentions claude-code, claude-desktop, cursor and openclaw. That is what the text claims, not a compatibility test we ran.
How current is this page?
The grade is for one exact copy of the source (79d91524ef4c), read on 2026-10-26. The repository is watched, and a new audit runs when it changes — this is the first audit.

Sources

Spotted something wrong? Report a correction · Methodology

Keep going in your AI

Opens with this page as the source. We add nothing else to the prompt.