The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses the imsg command-line utility to read from and write to the macOS Messages database.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external sources (incoming messages) through the imsg history and imsg watch commands.
Ingestion points: imsg history and imsg watch allow external message content into the agent's context.
Boundary markers: There are no instructions for the agent to treat message content as untrusted or to ignore embedded instructions.
Capability inventory: The agent has the ability to send messages (imsg send) and potentially execute other shell commands.
Sanitization: No sanitization or filtering of message content is performed before processing.
[PRIVILEGE_ESCALATION]: Instructions require the user to grant Full Disk Access to the terminal application. This is a broad permission that allows the imsg tool (and the agent) to read the sensitive Messages database (chat.db) as well as other protected system and user files.
[EXTERNAL_DOWNLOADS]: The skill requires installing a third-party tool from an external Homebrew tap (steipete/tap/imsg).

imessage