wiki
Warn
Audited by Gen Agent Trust Hub on Apr 20, 2026
Risk Level: MEDIUMDATA_EXFILTRATIONCOMMAND_EXECUTIONPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [DATA_EXFILTRATION]: The skill accesses highly sensitive local databases, specifically ~/Library/Messages/chat.db (iMessage history) and the macOS AddressBook SQLite database. Accessing these locations exposes the user's entire private communication history and contact list to the agent.
- [COMMAND_EXECUTION]: The ingestion and maintenance workflows rely on executing multiple local Python scripts (fetch_gmail.py, fetch_imessages.py, resolve_contacts.py) via shell subprocesses to extract and manipulate data from system databases and remote APIs.
- [PROMPT_INJECTION]: The skill is vulnerable to Indirect Prompt Injection. Ingestion points: Untrusted data enters the agent context from wiki/raw/emails/ and wiki/raw/imessages/ in the ingest.md workflow. Boundary markers: There are no explicit delimiters or instructions provided to the LLM agents (Haiku/Sonnet) to disregard embedded instructions within the source data. Capability inventory: The agent has the capability to write files (wiki notes, index, log) and execute local scripts. Sanitization: No evidence of sanitization or filtering of external message content exists before it is processed by the agents.
- [EXTERNAL_DOWNLOADS]: The skill is designed to fetch remote data from Gmail servers as part of its core ingestion pipeline.
Audit Metadata