The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/photos-search-content.sh unsafely interpolates user-provided search queries into an AppleScript block executed via osascript. An attacker or malicious user could provide a crafted query to execute arbitrary AppleScript, which in turn can execute arbitrary shell commands via the do shell script command.
[COMMAND_EXECUTION]: Multiple scripts, including scripts/photos-search-person.sh, scripts/photos-export.sh, and scripts/photos-info.sh, perform unsafe interpolation of user-supplied arguments (such as person names or UUIDs) directly into SQLite query strings. This creates a SQL injection vulnerability that allows for unauthorized data extraction from the Photos database.
[PRIVILEGE_ESCALATION]: The skill instructions in SKILL.md require the user to grant 'Full Disk Access' to the terminal application. This permission is extremely broad, allowing the agent to bypass macOS privacy protections (TCC) not just for Photos, but also for sensitive data in other applications like Mail, Messages, and Safari.
[DATA_EXFILTRATION]: The skill accesses highly sensitive personal data, including face recognition IDs, GPS location coordinates, and private images. The scripts/photos-export.sh script specifically copies private images to /tmp/photo_export.jpg. Since /tmp is a world-readable directory on macOS, this exposes private user content to any other user or process on the system.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted metadata (such as photo filenames and person names) from the Photos database without sanitization, creating an attack surface for indirect prompt injection.
Ingestion points: User-influenced data like filenames and recognized person names are retrieved from Photos.sqlite in several scripts.
Boundary markers: None; the data is retrieved and processed as raw text.
Capability inventory: The skill can execute shell commands (sqlite3, mkdir, cp, sips), AppleScript (osascript), and write to the file system.
Sanitization: The retrieved metadata is interpolated into command strings and returned to the agent context without any escaping or validation.

apple-photos