The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted incoming chat messages, which creates a significant vulnerability where an external party could send instructions to the agent. Ingestion points: imsg history and imsg watch commands in SKILL.md. Boundary markers: There are no delimiters or instructions to treat message content as data rather than commands. Capability inventory: The skill allows reading chat history and sending new messages (SKILL.md). Sanitization: None specified.
[PRIVILEGE_ESCALATION]: The skill requires the user to grant Full Disk Access to the terminal, a high-impact permission that allows the agent to bypass standard macOS file system protections. Evidence: Instructions in SKILL.md to 'Grant Full Disk Access for terminal'.
[EXTERNAL_DOWNLOADS]: The skill directs the user to install a utility from a third-party Homebrew repository. Evidence: Command brew install steipete/tap/imsg in SKILL.md.
[DATA_EXFILTRATION]: The skill provides access to sensitive personal communications and the ability to send messages, which could be combined by an attacker to exfiltrate private information. Evidence: Access to imsg history and imsg send (SKILL.md).
[COMMAND_EXECUTION]: The skill relies on executing the imsg CLI tool to interact with the macOS Messages application. Evidence: Multiple imsg commands listed in SKILL.md.

imessage