Imsg 1.0.0

• Analyzed: May 12, 2026, 4:28 AM
• Findings: 0
• Version: 1.0.0
• Hash: 308f4ef91e7b0fb3817356dd3d4e3316e5819e7009045cf699c69a6022bbd070
• Source: palm
• External report: View on VirusTotal

Overview

Type: OpenClaw Skill Name: imsg-1-0-0 Version: 1.0.0 The skill bundle instructs the agent to install the 'imsg' tool from a third-party Homebrew tap (`steipete/tap/imsg`). The `SKILL.md` documentation explicitly states that the 'imsg' tool requires 'Full Disk Access' and 'Automation permission to control Messages.app' on macOS. Furthermore, it demonstrates the ability to send arbitrary files via iMessage/SMS using the `--file` argument. While these permissions and capabilities are plausibly necessary for the tool's stated purpose, they introduce a significant security risk due to the broad access to the filesystem and the potential for data exfiltration if the 'imsg' binary itself were compromised or misused. The reliance on a third-party binary with such high privileges, even without direct malicious instructions for the agent, warrants a 'suspicious' classification.