Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

send-imessage

Send iMessages via macOS Messages app using AppleScript. Use when user wants to send a text message/SMS to a phone number. Supports Chinese and English messa...

MIT-0 · Free to use, modify, and redistribute. No attribution required.
0 · 146 · 1 current installs · 1 all-time installs
MIT-0
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Benign
high confidence
Purpose & Capability
The name/description and SKILL.md are consistent: the skill sends iMessages via AppleScript. However the registry metadata does not declare that this is macOS-only even though it requires osascript/AppleScript and the Messages app; that mismatch should be corrected.
Instruction Scope
SKILL.md contains explicit steps to extract phone number and message and run a single osascript block to send the message. It does not instruct reading unrelated files, accessing extra environment variables, or exfiltrating data.
Install Mechanism
There is no install spec and no code files; this is instruction-only, so nothing is downloaded or written to disk by the skill itself.
Credentials
The skill requests no environment variables or credentials. It properly notes runtime requirements (Messages logged in, Accessibility permissions) which are proportional to sending messages.
Persistence & Privilege
always is false (good). disable-model-invocation is false (normal), which means the agent could autonomously invoke the skill — this increases the risk of the agent sending messages without extra confirmation, though it is not combined with other concerning privileges.
Assessment
This skill is coherent for sending iMessages but only works on macOS with the Messages app signed in. Before installing: confirm you'll run it on macOS; be aware the agent can call the skill autonomously (consider requiring manual confirmation before sending messages); macOS may require Accessibility permission for osascript to control Messages. Also ask the publisher to set the skill's OS restriction to macOS to avoid accidental use on unsupported systems.

Like a lobster shell, security has layers — review code before you run it.

Current versionv1.0.0
Download zip
latestvk976wqa6xs2v90bybtd5d1sy5x82n6yb

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

SKILL.md

iMessage Skill

Send iMessages using macOS Messages app via AppleScript.

Usage

When user asks to send a message to a phone number:

  1. Extract the phone number and message from user's request
  2. Format phone number with +1 prefix for US numbers (e.g., 8888888888 -> +18888888888)
  3. Use AppleScript to send the message

AppleScript Command

osascript << 'EOF'
tell application "Messages"
    activate
    send "MESSAGE_TEXT" to buddy "+1PHONE_NUMBER"
end tell
EOF

Examples

Send English message:

  • User: "send message to 8888888888, say hello"
  • Command: send "hello" to buddy "+18888888888"

Send Chinese message:

  • User: "send to 8888888888 你好"
  • Command: send "你好" to buddy "+18888888888"

Notes

  • The Messages app must be logged into iMessage/FaceTime
  • If AppleScript fails, macOS may need Accessibility permissions in System Settings > Privacy & Security > Accessibility
  • Works with any text content (English, Chinese, emoji, etc.)

Files

1 total
Select a file
Select a file to preview.

Comments

Loading comments…