The Agent Skills Directory

[DATA_EXFILTRATION]: The skill accesses highly sensitive personal information, including full iMessage and SMS chat histories, contact details (phone numbers and Apple IDs), and message attachments. This involves reading the local Messages.app database which requires Full Disk Access.
[EXTERNAL_DOWNLOADS]: The skill automates the installation of an external binary via a third-party Homebrew repository (steipete/tap/imsg). This introduces a dependency on untrusted external code not provided by the platform or well-known service providers.
[COMMAND_EXECUTION]: The skill relies on executing shell commands (imsg chats, imsg history, imsg send) to perform its functions. These commands allow the agent to read from the filesystem and trigger system-level automation to send messages.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection. It ingests untrusted data from external sources (incoming messages) through imsg history or imsg watch. If a received message contains malicious instructions, the agent may attempt to execute them.
Ingestion points: The outputs of imsg chats and imsg history (JSON format) containing user-generated message content.
Boundary markers: Absent. There are no instructions to the agent to treat message content as untrusted data or to ignore embedded commands.
Capability inventory: The skill possesses the capability to read sensitive data (history) and perform actions (send) which can be chained in an attack.
Sanitization: Absent. No logic is provided to sanitize or escape message content before it is processed by the agent.

imsg