The Agent Skills Directory

[DATA_EXFILTRATION]: The skill identifies and accesses sensitive file paths containing private user data.
Evidence: It verifies the existence and accessibility of ~/Library/Messages/chat.db, which holds the user's complete iMessage history.
Evidence: It reads ~/.claude/channels/imessage/access.json to process contact identifiers and access policies.
[COMMAND_EXECUTION]: The skill uses shell commands to probe system-level security permissions.
Evidence: It executes ls ~/Library/Messages/chat.db to check for Full Disk Access (FDA) privileges.
[PROMPT_INJECTION]: The skill exhibits risk factors for both identity deception and indirect instruction injection.
Evidence: There is a discrepancy between the author identified in the analysis context ('420company') and the author metadata in the SKILL.json file ('Anthropic/3p'), which may mislead the user as to the skill's source.
Ingestion points: The agent processes configuration data from ~/.claude/channels/imessage/access.json at runtime.
Boundary markers: There are no delimiters or specific instructions to ignore malicious commands embedded within the access policy data.
Capability inventory: The skill utilizes the Read and Bash tools, which could be exploited if the ingested data contains instructions meant to hijack the agent.
Sanitization: No validation or sanitization of the JSON content is performed before the agent integrates it into its decision-making logic.

configure