The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill requires the installation of a third-party binary imsg from an external Homebrew tap (steipete/tap/imsg). This binary is not provided by the skill author or a platform-recognized trusted vendor, posing a supply chain risk as it gains access to sensitive communications.
[DATA_EXFILTRATION]: The tool is designed to read personal communication data from the macOS iMessage database (chat.db). To function, it explicitly requires 'Full Disk Access', a high-privilege permission that grants the agent capability to read private messages, which could then be processed or potentially moved out of the local environment.
[COMMAND_EXECUTION]: The skill instructions direct the agent to execute shell commands using the imsg binary. These commands include listing chat history, watching for new messages, and sending texts or files.
[PROMPT_INJECTION]: The skill is susceptible to Indirect Prompt Injection (Category 8):
Ingestion points: imsg history and imsg watch commands ingest untrusted text data from incoming SMS and iMessages into the agent's context.
Boundary markers: The skill provides no instructions for the agent to treat message content as untrusted or to use delimiters to separate message data from system instructions.
Capability inventory: The agent has the capability to send messages (imsg send) and access local files, which could be abused if malicious instructions are embedded in a received message.
Sanitization: No sanitization or validation logic is defined to prevent the agent from obeying instructions contained within the message history.

imsg