add-imessage
Pass
Audited by Gen Agent Trust Hub on Aug 6, 2026
Risk Level: SAFECOMMAND_EXECUTIONCREDENTIALS_UNSAFEDATA_EXFILTRATIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local setup scripts (
setup/channels/imessage-configure.sh,setup/lib/restart.sh) and usespnpmto build and test the newly added iMessage adapter. - [DATA_EXFILTRATION]: For local integration on macOS, the skill is designed to access the user's iMessage database (
chat.db). This is the primary purpose of the skill and requires a manual grant of 'Full Disk Access' by the user to the Node.js runtime. - [CREDENTIALS_UNSAFE]: The skill collects a Photon API key from the user for remote operations. This secret is passed as a command-line argument to a configuration script before being stored in a
.envfile. While standard for this setup, secrets in shell arguments can potentially be visible in system process lists. - [EXTERNAL_DOWNLOADS]: The skill installs the
chat-adapter-imessagepackage and retrieves specific source files from an external git branch (channels) to implement the bridge functionality.
Audit Metadata