The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes the imsg CLI tool to interface with the macOS Messages application. Executing these commands requires granting the terminal Full Disk Access and Automation permissions, which provides the agent with broad access to the user's private message database and the ability to send communications.
[INDIRECT_PROMPT_INJECTION]: The skill incorporates an attack surface for indirect prompt injection because it reads untrusted external data. Incoming iMessages or SMS content processed via imsg history or imsg watch could contain malicious instructions designed to hijack the agent's context. While the skill mandates user confirmation before sending messages, the initial ingestion of message history lacks explicit sanitization or strict boundary markers for the data being read.
Ingestion points: Reading chat history and watching for new messages via imsg history and imsg watch (SKILL.md).
Boundary markers: The skill includes a rule to "Always confirm recipient and message content," which serves as a manual check but does not provide technical delimiters for the ingested text.
Capability inventory: The agent can send messages (imsg send) and read local files when sending attachments.
Sanitization: There are no instructions for the agent to sanitize or escape the content of received messages before processing them.

imessage