The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The script scripts/signal-search-fast uses the macOS security find-generic-password command to extract the 'Signal Safe Storage' password from the system Keychain. This password is then used to decrypt the Signal Desktop database, bypassing standard application security boundaries.
[DATA_EXFILTRATION]: The skill accesses highly sensitive user data by reading the Signal Desktop configuration file (config.json) and the encrypted SQLite database (db.sqlite) located in ~/Library/Application Support/Signal/. This provides the agent with full access to the user's private message history and contact metadata.
[COMMAND_EXECUTION]: The skill executes multiple subprocesses, including the security utility for credential retrieval and nix-shell for environment management. The legacy search script additionally constructs and executes shell command strings for sigexport and ripgrep.
[EXTERNAL_DOWNLOADS]: The skill uses nix-shell to dynamically download and install several third-party dependencies at runtime, including sqlcipher3, pycryptodome, signal-export, and ripgrep from the Nix package registry.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted text from Signal message bodies, which may contain malicious instructions designed to influence the agent's behavior.
Ingestion points: Signal message content is extracted and printed to the agent context by the search_messages and dump_day functions in scripts/signal-search-fast.
Boundary markers: Absent. The output format [timestamp] Chat Name | Sender: Message does not use delimiters or warnings to isolate untrusted content.
Capability inventory: The agent has the ability to execute shell commands and read/write local files through the provided scripts (scripts/signal-search, scripts/signal-history-search).
Sanitization: Absent. The message body is processed and displayed without escaping or content filtering.

signal-history-search