Imessage Notify
Security checks across static analysis, malware telemetry, and agentic risk
Overview
The skill does what it says (uses AppleScript to send iMessage via the local Messages app) but it contains hard-coded Apple ID/email addresses and instructions that can cause automated exfiltration of local files to a third party, which is inconsistent with a safe, generic 'send notifications to your phone' skill.
Before installing or enabling this skill, review and modify the scripts: 1) Replace the hard-coded recipient and sender addresses with your own Apple ID or require an explicit --recipient argument; 2) Never integrate these scripts into automated tasks that handle sensitive data unless you add explicit confirmation prompts and strict path whitelisting; 3) Test with a non-sensitive message first to verify it uses your Messages account; 4) Do not run these on shared machines or CI runners (they will attach and send any file paths you pass); 5) If you want automatic notifications, consider adding safeguards (prompting, logging, or limiting attachments) and a configuration step that requires the installing user to opt-in and set their own recipient. Because the default behavior will send files to a third-party address, avoid enabling this skill until you remove the hard-coded addresses and confirm it uses your account.
Static analysis
No static analysis findings were reported for this release.
VirusTotal
No VirusTotal findings
Risk analysis
No visible risk-analysis findings were reported for this release.