The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The skill requires the user to grant 'Full Disk Access' to the terminal environment. On macOS, this is a high-privilege permission that allows the agent to bypass standard application sandboxing and access protected system databases, including the local Messages database.
[DATA_EXFILTRATION]: The skill accesses highly sensitive personal data, including iMessage/SMS chat history, contact details, and message content through the imsg history and imsg chats commands.
[EXTERNAL_DOWNLOADS]: The skill relies on an external, third-party CLI tool (imsg) provided via a Homebrew tap (steipete/tap/imsg). This dependency is not part of the standard operating system or a trusted vendor list, representing a supply-chain risk if the third-party repository were compromised.
[COMMAND_EXECUTION]: The skill uses the imsg command to interact with the system. While the instructions include rules for confirmation, the agent has the capability to send messages and attachments without further system-level technical restrictions once permissions are granted.
[PROMPT_INJECTION]: The skill is vulnerable to Indirect Prompt Injection (Category 8).
Ingestion points: The agent reads untrusted data from the environment via imsg history, imsg watch, and imsg chats in SKILL.md.
Boundary markers: No boundary markers or 'ignore embedded instructions' warnings are present to distinguish between message data and system instructions.
Capability inventory: The agent possesses the capability to send messages (imsg send) and read local files for attachments.
Sanitization: No sanitization or validation of the message content is performed before the agent processes it, allowing a remote sender to potentially influence the agent's behavior by sending a malicious iMessage.

imessage