apple-bridges

SUSPICIOUS: The skill’s capabilities are mostly coherent with its purpose, and the flagged pre-execution/prompt-injection findings are largely documentation artifacts. The main risk is trust in broad local bridge binaries installed under ~/.claude plus powerful permissions for mail, messages, and tmux; this is proportionate to the stated Apple-app automation purpose but still medium risk because the binaries are external to the skill and not strongly verified in the skill itself.

The fragment documents a messaging utility that reads private Messages data and sends user-specified messages and attachments through Messages.app. Immediate, unconfirmed sending and access to sensitive message history are notable privacy and operational risks, but the documentation provides no evidence of malware or exfiltration. The binary implementation is not supplied, so its behavior cannot be independently verified; severity is elevated for privacy and accidental-send risk, not established maliciousness.