T09 · Insecure Skill Coding Practices
Error
- Location
scripts/send-imessage-media.sh:57- Finding
AppleScript Injection Through Unescaped User-Controlled Arguments
- Content
View full analysis
- Remediation
View remediation
Security audit
Imessage Notify
Security checks for vulnerabilities and agentic risk
Overview
This skill is meant to send iMessage notifications, but it is preconfigured to send text and files to a hard-coded personal Apple ID and builds AppleScript unsafely from user input.
Review this skill carefully before installing. Do not use it as published unless the hard-coded Apple IDs are replaced with your own explicit local configuration, recipient confirmation is added for sensitive sends, and the AppleScript construction is fixed to pass user input as arguments rather than executable source.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/send-imessage.sh:7- Finding
Hard-Coded Personal Recipient Can Cause Unintended Disclosure of Messages and Local Files
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (8)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The skill documentation promises broad iMessage notification capabilities but also indicates hard-coded account behavior and omits material permissions/behavior details such as AppleScript control of Messages. This mismatch is dangerous because users may trust the declared purpose while the implementation routes messages to a fixed recipient or behaves differently than expected, creating a meaningful risk of unintended disclosure or unauthorized message transmission.
- Content
Natural-Language Policy Violations
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
Hard-coding a specific personal Apple ID into the skill documentation indicates the workflow is tied to a non-generic recipient/account rather than the end user's chosen destination. In this skill's context, that materially increases the risk that automated notifications, message bodies, or attachments are sent to the wrong person, turning ordinary task output into direct data exfiltration.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger language is broad enough to activate on common requests about notifications or messaging, potentially causing the skill to be selected outside a narrow, intended automation context. In a messaging skill that can transmit content off-system, overly broad activation increases the chance of accidental data sharing or misuse without sufficiently specific user intent.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The documentation describes sending messages and attachments but does not clearly warn that content will be transmitted through Messages/iMessage to another endpoint. Without this disclosure, users may include sensitive text or files believing the action is local automation rather than external transmission, increasing the risk of inadvertent data leakage.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The documentation exposes a specific Apple ID email address that is not necessary for understanding how to use the skill. Publishing personal account identifiers increases privacy risk, may enable targeting or abuse of that account, and suggests the skill is preconfigured to interact with a non-user-specific identity.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Allowing the recipient to be overridden is a sensitive capability because it can redirect notifications and attached files to an unintended or attacker-controlled account. Omitting a warning about this behavior makes accidental or unauthorized exfiltration more likely, especially in automated task contexts where file paths or parameters may be constructed dynamically.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The script hard-codes a default external recipient and immediately uses it unless overridden, which can route notifications, file attachments, and other task output to a personal account without explicit user approval at send time. In an agent skill context, this creates a data exfiltration path because arbitrary task results or local files could be forwarded off-system through Messages.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The script sends text and attachments to the default recipient without any confirmation, warning, or interactive consent, so misuse or accidental invocation can transmit sensitive content externally with no friction. Because this skill is specifically designed for automated notifications, the lack of a confirmation boundary makes unintended data disclosure more dangerous than in a purely manual messaging script.
- Content
Static analysis
No suspicious patterns detected.