applescript
Expert in AppleScript and JXA for macOS automation, focusing on secure script execution and application integration.
Install this skill
Security score
The applescript skill was audited on Feb 9, 2026 and we found 18 security issues across 2 threat categories, including 2 high-severity. Review the findings below before installing.
Categories Tested
Security Issues
Template literal with variable interpolation in command context
| 191 | throw new Error(`Access to ${appName} is blocked`); |
Destructive rm -rf command
| 402 | set userInput to "test; rm -rf /" |
Destructive rm -rf command
| 406 | set userInput to "test; rm -rf /" |
Python subprocess execution
| 75 | result = subprocess.run(['osascript', '-e', script], capture_output=True) |
Python subprocess execution
| 115 | result = subprocess.run(['osascript', '-e', script], |
Python subprocess execution
| 213 | result = subprocess.run(['sdef', f'/Applications/{app_name}.app'], |
Python subprocess execution
| 262 | result = subprocess.run(['osascript', '-e', script], |
Python subprocess execution
| 282 | result = subprocess.run(['osascript', '-e', script], capture_output=True) |
Python subprocess execution
| 291 | subprocess.run(['osacompile', '-o', path, '-e', script]) |
Python subprocess execution
| 293 | return subprocess.run(['osascript', self._cache[script_id]], capture_output=True) |
Python subprocess execution
| 300 | subprocess.run(['osascript', '-e', f'tell app "{app}" to set bounds...']) |
Python subprocess execution
| 301 | subprocess.run(['osascript', '-e', f'tell app "{app}" to activate']) |
Python subprocess execution
| 308 | subprocess.run(['osascript', '-e', script], capture_output=True) |
Python subprocess execution
| 315 | result = subprocess.run(['osascript', '-e', script], capture_output=True) |
Python subprocess execution
| 345 | subprocess.run(['osascript', '-e', f'tell app "{app}" to activate']) |
Access to system keychain/keyring
| 104 | BLOCKED_APPS = ['Keychain Access', '1Password', 'Terminal', 'System Preferences'] |
Access to system keychain/keyring
| 186 | this.blockedApps = ['Keychain Access', 'Terminal', 'System Preferences']; |
Access to system keychain/keyring
| 247 | runner.execute('tell application "Keychain Access" to activate') |