Send images from Mac to phone via iMessage

This skill appears to do what it says: it copies images to ~/Pictures/openclaw-send, saves a small JSON config at ~/.openclaw/workspace/imessage-sender-config.json, and uses osascript to send the image via the Messages app. Before installing or running: (1) inspect the script yourself (it is included) and verify you are comfortable with it writing to those paths; (2) be aware macOS will likely ask you to allow automation access to Messages; (3) test with a non-sensitive image and a number you control; (4) note a minor mismatch: saving a default recipient does not get used by the send command — the script expects an explicit recipient for send; (5) the script interpolates the recipient into AppleScript without sanitization, so avoid passing untrusted strings as the recipient. If you want tighter privacy, consider editing the script to store and use the default recipient and to validate/sanitize inputs.

Type: OpenClaw Skill Name: images-sender Version: 1.0.0 The skill provides a utility to send images via iMessage using AppleScript, but it contains a significant command injection vulnerability. In `scripts/send.py`, the `send_imessage` function constructs an AppleScript string using f-strings with unsanitized input (`send_path` and `formatted_recipient`), which could allow an attacker to execute arbitrary AppleScript or shell commands if a crafted filename or recipient string is provided. While the intent appears functional, the high-risk nature of unsanitized `osascript` execution warrants a suspicious classification.