Security audit

Imessage Notify

Security checks for vulnerabilities and agentic risk

Overview

The skill really sends iMessages, but it defaults to a specific hardcoded Apple ID and can transmit text, screenshots, files, and URLs without a safety gate.

Review this carefully before installing. Do not use it unless fan.xia@qq.com is intentionally your own recipient or you first change the scripts to require a local user-configured recipient. Avoid using it for automated tasks that handle secrets, screenshots, reports, or private files unless you add explicit confirmation and proper AppleScript escaping.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The skill is presented as a way to notify the user's own iPhone, but the documentation indicates a hardcoded external Apple ID and a recipient override that can send messages to arbitrary contacts. In an automation context, this can silently exfiltrate task output, files, screenshots, or links to unintended recipients, making the behavior materially broader and riskier than advertised.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: Publishing a specific Apple ID email in the skill documentation unnecessarily exposes personal or operational contact information. This increases privacy risk and may facilitate unwanted messaging, targeting, or accidental delivery of automated notifications to the wrong person.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The script permits the caller to override the default recipient with an arbitrary Apple ID or phone number, which turns a phone-notification utility into a general outbound messaging primitive. In an agent/automation context, this increases risk of unauthorized exfiltration, spam, or social-engineering messages because untrusted task data can direct where messages and attachments are sent.

Description-Behavior Mismatch

Medium

Confidence: 98% confidence
Finding: The script hard-codes both the sending account context and the recipient Apple ID, despite presenting itself as a generic way to notify the user's own iPhone. This can silently route sensitive task output or alerts to a third-party address, creating a real confidentiality breach in an automation context where users may assume messages are delivered only to themselves.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The trigger language is broad enough to activate on many general requests about notifications or messaging, which can cause this skill to be selected in contexts the user did not specifically intend. Because the skill can transmit content externally via iMessage, overbroad matching increases the chance of unintended data disclosure or misuse.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The documentation explains how to send text, files, screenshots, media, and URLs but does not clearly warn that these artifacts are transmitted through Messages/iMessage to a recipient. In an agentic workflow, users may not realize local files or generated reports are leaving the local system, which raises confidentiality and consent concerns.

Natural-Language Policy Violations

Low

Confidence: 93% confidence
Finding: Exposing a specific Apple ID in public-facing skill documentation is unnecessary and creates avoidable privacy and operational risk. While lower severity than active exfiltration behavior, it still discloses identifying information that should not be embedded without justification.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The script is configured with a real default recipient and immediately transmits messages or files without any confirmation or safety gate. In an automated skill, this can cause accidental disclosure of sensitive text or attachments to a real person/device, especially if the skill is invoked indirectly or with unexpected inputs.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The script sends arbitrary message content to a hard-coded recipient without meaningful disclosure or confirmation of the destination. In a notification skill, this is especially dangerous because automated tasks may include secrets, personal data, or operational details, and users are likely to trust that 'notify my phone' means their own device rather than an embedded external account.

Static analysis

No suspicious patterns detected.