Security audit

iMessage & Signal Analyzer

Security checks for vulnerabilities and agentic risk

Overview

This skill is not obviously malicious, but it handles private message histories with broad permissions and weak safeguards that could expose more conversations than intended.

Review this carefully before installing. Only run it on message histories you have clear permission to analyze, prefer user-exported data over broad system access, avoid granting Full Disk Access to a general terminal or Python interpreter unless absolutely necessary, and revoke it immediately afterward. Use exact phone numbers or handles, avoid broad searches, and assume terminal output may contain private messages and contact details.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: SKILL.md:16
Finding: Overbroad Full Disk Access Recommendation
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/analyze.py:27
Finding: Ambiguous iMessage Handle Matching Can Expose Unrelated Conversations
Content: View full analysis
2 else input("Phone/Handle: ").strip() ``` ### Technical Analysis The SQL statements use parameter binding, so this is not SQL injection. The security issue is the matching policy: arbitrary input is surrounded by `%` wildcards without minimum-length, format, or empty-value validation. An empty value produces `LIKE '%%'`, which matches every handle. A short or partial phone number, email fragment, or common domain can also match multiple unrelated handles. The script then queries chats associated with all matched handles and prints recent message text. Although the script reports the number and names of matching handles, it does not require confirmation when the ...[truncated 974 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/analyze.py:49
Finding: Group-Chat Messages Are Exposed and Misattributed to the Selected Contact
Content: View full analysis
100 else (m['text'] or '') sender = "You" if m['is_from_me'] else "Them" try: if source == "iMessage": ts = datetime(2001, 1, 1) + timedelta(seconds=m['date'] or 0) else: ts = datetime.fromtimestamp(m['date']) ts_str = ts.strftime('%Y-%m-%d') except: ts_str = "?" print(f" [{ts_str}] {sender}: {text}") ``` ### Technical Analysis The query finds every chat containing the selected handle and then selects every message in each matching chat. It does not restrict results to one-to-one conversations and does not retrieve the actual sender handle for each message. If the selected contact participates in a group chat, messages written by every other participant in ...[truncated 1194 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: scripts/analyze.py:96
Finding: Signal No-Match Error Enumerates Unrelated Contact Details
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The documentation tells users how to grant Full Disk Access to Python or a terminal app in order to reach ~/Library/Messages/chat.db, but it does not prominently warn that this enables reading extremely sensitive local communications and potentially broader filesystem access by that app. Because the skill is specifically designed to inspect private conversations and infer relationship dynamics, this omission materially increases privacy and abuse risk.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill can read highly sensitive local data sources (iMessage chat history, AddressBook database, Signal exports) but does not declare any explicit tool scope or permission boundaries. That makes the effective data-access surface opaque and increases the chance the skill is invoked without clear user understanding that private message history and contacts may be accessed.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The description uses broad trigger phrases like analyzing messages, reading message history, checking conversation patterns, or evaluating a relationship, which can match common conversational requests and cause overbroad auto-invocation. In this skill's context, accidental invocation is more dangerous because it targets intimate communications and relationship inferences from sensitive personal data.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script accesses a highly sensitive local iMessage database and prints matching handles and recent message content to stdout without any privacy notice, confirmation step, or output minimization. In a skill explicitly designed to analyze private relationship communications, this increases the risk of inadvertent disclosure through terminal logs, agent transcripts, screenshots, or shared sessions.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The Signal path loads exported conversation history from JSON and prints recipient details and recent message contents with no user-facing warning or consent checkpoint. Because Signal exports can contain sensitive plaintext archives, this behavior can easily leak private communications into console history, logs, or agent-visible outputs in a context centered on intimate relationship analysis.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The advertised purpose includes revealing tone samples and evaluating relationship dynamics based on text history. The actual analysis computes message counts, yearly volume, crude initiation estimates, silence gaps, and shows recent message excerpts; it does not perform sentiment, tone, or relationship-quality analysis beyond simple heuristics.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The manifest says the skill analyzes Signal conversation history on Linux/Windows and macOS, which implies direct analysis of existing message history. In this file, Signal support only reads a user-supplied export file and even instructs the user to use signal-cli to create it, which is a narrower behavior than the description suggests.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.