The Agent Skills Directory

[DATA_EXFILTRATION]: The skill is explicitly designed to bypass the macOS Transparency, Consent, and Control (TCC) security framework. It facilitates the reading of protected databases including iMessages (chat.db) and Address Book data.
[DATA_EXFILTRATION]: It exfiltrates private user data by copying it from restricted system directories to the world-readable /tmp directory, making sensitive information accessible to any process or user on the system.
[COMMAND_EXECUTION]: The skill uses osascript to delegate file operations to Terminal.app. This technique exploits the fact that child processes of Terminal.app inherit its Full Disk Access (FDA) permissions, allowing the agent to perform privileged actions without having its own FDA grant.
[COMMAND_EXECUTION]: The provided implementation script is vulnerable to shell command injection. The $SRC and $DEST_DIR variables are interpolated directly into the AppleScript execution string without sanitization, allowing an attacker to execute arbitrary commands with the privileges of Terminal.app.

fda-read