The Agent Skills Directory

[COMMAND_EXECUTION]: Several AppleScripts utilize the do shell script command to execute system utilities such as screencapture, brightness, and sqlite3.
The script read-recent-messages.applescript is vulnerable to local SQL injection because it constructs a SQL query for the sensitive iMessage database (chat.db) using string concatenation with an unsanitized user-provided variable (contactIdentifier). An attacker could supply a specially crafted identifier to execute arbitrary SQL queries against the local database.
[DATA_EXFILTRATION]: The skill accesses highly sensitive user data from various macOS databases and applications:
read-recent-messages.applescript: Directly reads the private iMessage database at ~/Library/Messages/chat.db.
fetch-all-contacts.applescript: Extracts all contact names and phone numbers.
notes-manager.applescript and reminders-manager.applescript: Retrieves full content of user notes and reminders.
get-safari-page-info.applescript: Extracts the title, full text, and HTML source of the active browser page.
[DYNAMIC_EXECUTION]: The skill facilitates dynamic code execution in two ways:
run-safari-javascript.applescript: Allows for the execution of arbitrary JavaScript code within the security context of the Safari browser, which could be abused for session hijacking or data theft if the input is untrusted.
Swift scripts (window-manager.swift, clipboard.swift, capture-active-screen.swift) are executed at runtime using the swift interpreter.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a significant attack surface for indirect prompt injection as it ingests untrusted data from external sources.
Ingestion points: Reads data from incoming iMessages, Safari page content, and shared notes.
Boundary markers: Instructions lack robust delimiting or warnings to ignore embedded commands in the processed data.
Capability inventory: The skill has broad capabilities including file system access, message sending, and script execution.
Sanitization: There is a lack of proper sanitization, most notably in the SQL query construction in read-recent-messages.applescript.

altic-studio