by 安全扫描
OpenClaw
安全
medium confidenceThe skill's instructions and requirements line up with an iMessage/SMS CLI for macOS, but you should verify the third‑party Homebrew tap and be cautious granting Full Disk Access and Automation permissions.
评估建议
This skill appears to do what it says: it's a wrapper around a macOS 'imsg' CLI. Before installing: (1) verify the Homebrew formula's source (the metadata points to the third‑party tap 'steipete/tap') — inspect the formula and its GitHub repo to ensure it's trustworthy; (2) be aware that granting Full Disk Access to your terminal and Automation permission for Messages.app allows the CLI to read your message database and attachments — only grant these to a terminal you trust or consider creating ...详细分析 ▾
✓ 用途与能力
The name/description (iMessage/SMS CLI) match the runtime instructions which call the 'imsg' CLI to list chats, history, watch, and send. Requiring Messages.app to be signed in and macOS permissions (Full Disk Access and Automation) is consistent with reading/sending Messages data.
✓ 指令范围
SKILL.md only instructs using the 'imsg' CLI and documents expected flags and macOS permissions. It does not ask to read unrelated files, export data to external endpoints, or access unrelated credentials. It does reference local file paths for attachments (which is expected).
ℹ 安装机制
The skill is instruction-only (no code shipped), but its metadata recommends installing a Homebrew formula from the steipete/tap ('steipete/tap/imsg'). Installing from a third‑party tap is a moderate-risk install vector compared with an official Homebrew/core formula — you should review the formula/source before installing.
✓ 凭证需求
The skill declares no environment variables, no credentials, and no config paths. The macOS permissions (Full Disk Access, Automation control of Messages.app) are sensitive but proportionate to an iMessage CLI that reads and sends Messages.
✓ 持久化与权限
The skill is not set to always:true and does not request special platform-wide persistence. Model invocation is allowed (platform default); that is expected for a user-invocable skill and not a standalone concern here.
安全有层次，运行前请审查代码。
运行时依赖
🖥️ OSmacOS
版本
latestv1.0.02026/1/5
● 可疑
安装命令
点击复制官方npx clawhub@latest install imsg
镜像加速npx clawhub@latest install imsg --registry https://cn.longxiaskill.com