The Agent Skills Directory

[COMMAND_EXECUTION]: The skill's workflow in SKILL.md instructs the agent to execute shell commands that incorporate unsanitized user input, such as a target WeChat name or phone number. This allows for arbitrary command injection on the host system if a user provides malicious parameters containing shell metacharacters.
[PRIVILEGE_ESCALATION]: The tools/wechat_decryptor.py tool performs invasive memory scanning (using pymem and lldb) to extract encryption keys from the memory of the running WeChat process. This is a high-risk behavior similar to credential harvesting. On macOS, the skill suggests disabling System Integrity Protection (SIP) or granting Full Disk Access to function, which significantly weakens the system's security. It also attempts to retrieve passwords directly from the macOS Keychain.
[DATA_EXFILTRATION]: The skill targets and reads highly sensitive personal data from private messaging databases (WeChat and iMessage). While processing is local, the presence of a command injection vulnerability combined with access to these sensitive databases presents a high risk of unauthorized data exposure.
[DYNAMIC_CONTEXT_INJECTION]: The SKILL.md file defines executable shell commands using backticks that are automatically suggested for execution by the agent. These commands handle sensitive database operations and process user-supplied arguments, automating the execution of potentially dangerous scripts.
[DYNAMIC_EXECUTION]: The decryption script generates and executes Python code dynamically via subprocess.run to perform memory analysis and process inspection.
[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests untrusted chat logs and screenshots to generate behavioral rules for the resulting persona. There are no clear boundary markers or sanitization mechanisms to prevent malicious payloads within the ingested chat data from manipulating the agent's logic.

create-ex