signal-history-search
Pass
Audited by Gen Agent Trust Hub on Mar 29, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: Executes the macOS
securitycommand-line utility to programmatically retrieve the 'Signal Safe Storage' encryption key from the system Keychain. - [DATA_EXPOSURE]: Accesses sensitive private user information by reading the Signal Desktop database located within the user's Library directory.
- [EXTERNAL_DOWNLOADS]: Employs
nix-shellto fetch and configure the necessary runtime environment, which includes downloading software dependencies such as SQLCipher bindings. - [PROMPT_INJECTION]: Provides a surface for indirect prompt injection because the skill processes untrusted message content from the Signal history.
- Ingestion points: Message text and conversation metadata from the Signal SQLite database tables.
- Boundary markers: Absent; there are no documented delimiters to separate message content from agent instructions.
- Capability inventory: Execution of shell commands for Keychain access and querying of local sensitive databases.
- Sanitization: No sanitization or filtering of the retrieved message content is performed before it enters the agent's context.
Audit Metadata