The Agent Skills Directory

[DATA_EXPOSURE_AND_EXFILTRATION]: The skill includes a detailed reference file docs/local-data-sources.md that instructs an agent on how to access and query highly sensitive local databases on macOS. These include iMessage (~/Library/Messages/chat.db), Contacts (~/Library/Application Support/AddressBook/AddressBook-v22.abcddb), Apple Notes, Screen Time, and Browser History for Safari, Chrome, and Brave. The documentation explicitly provides SQL queries for these targets and describes how to bypass database locks by copying files to the /tmp directory.
[DYNAMIC_EXECUTION]: Multiple Python scripts in the scripts/ directory (search-history.py, export-data.py, get-stats.py) construct SQL queries by interpolating command-line arguments directly into strings via f-strings. This pattern is vulnerable to SQL injection, potentially allowing an agent to execute arbitrary SQL commands if provided with malicious parameters for dates, search queries, or application names.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process voice dictation transcripts which are untrusted data captured from the user's environment.
Ingestion points: The History table in flow.sqlite (specifically formattedText and asrText fields) is read by all analysis scripts.
Boundary markers: The scripts do not implement delimiters or instructions to ignore embedded commands within the dictation data.
Capability inventory: The skill possesses the capability to execute shell commands (sqlite3), write to the local filesystem (HTML, JSON, and Markdown files), and read multiple sensitive local databases.
Sanitization: No semantic validation or sanitization is performed on the transcript content, meaning malicious instructions captured in dictation could potentially influence agent behavior when it processes the history.
[EXTERNAL_DOWNLOADS]: The dashboard generation script (scripts/create-dashboard.py) creates an HTML file that fetches the Chart.js library from a public Content Delivery Network (https://cdn.jsdelivr.net/npm/chart.js).
[COMMAND_EXECUTION]: The skill's primary functionality relies on executing a series of Python scripts and sqlite3 command-line utility calls to interact with the local filesystem and databases.

wispr-flow