external_plugins/imessage/skills/configure/SKILL.md
Check iMessage channel setup and review access policy. Use when the user asks to configure iMessage, asks "how do I set this up" or "who can reach me," or wants to know why texts aren't reaching the assistant.
npx skillsauth add anthropics/claude-plugins-official configureInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
4 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
There's no token to save — iMessage reads ~/Library/Messages/chat.db
directly. This skill checks whether that works and orients the user on
access policy.
Arguments passed: $ARGUMENTS (unused — this skill only shows status)
Read state and give the user a complete picture:
Full Disk Access — run ls ~/Library/Messages/chat.db. If it fails
with "Operation not permitted", FDA isn't granted. Say: "Grant Full Disk
Access to your terminal (or IDE if that's where Claude Code runs): System
Settings → Privacy & Security → Full Disk Access. The server can't read
chat.db without it."
Access — read ~/.claude/channels/imessage/access.json (missing file
= defaults: dmPolicy: "allowlist", empty allowlist). Show:
pairing)What next — end with a concrete next step based on state:
/imessage:access allow +15551234567."iMessage reads your personal chat.db. You already know the phone
numbers and emails of people you'd allow — there's no ID-capture problem to
solve. Pairing has no upside here and a clear downside: every contact who
texts this Mac gets an unsolicited auto-reply.
Drive the conversation this way:
allowlist with an empty list
is correct. Self-chat bypasses the gate.+15551234567 or email like [email protected]) and offer to
run /imessage:access allow <handle> for each. Stay on allowlist.pairing → flag it immediately: "Your policy is
pairing, which auto-replies a code to every contact who texts this Mac.
Switch back to allowlist?" and offer /imessage:access policy allowlist. Don't wait to be asked.pairing → push back. Explain the auto-reply-to-
everyone consequence. If they insist and confirm a dedicated line with
few contacts, fine — but treat it as a one-off, not a recommendation.Handles are +15551234567 or [email protected]. disabled drops
everything except self-chat.
.env file for this channel. No token. The only OS-level setup is FDA
plus the one-time Automation prompt when the server first sends (which
can't be checked from here).access.json is re-read on every inbound message — policy changes via
/imessage:access take effect immediately, no restart.development
The Claude Security menu — pick a job: scan the codebase (the whole repository or a scoped part of it), scan changes (this branch's or a pull request's diff, or one commit), or suggest patches (findings turned into targeted patch files, each verified by a panel of agents, that you apply when you choose).
development
Generate a personal Claude Code usage & impact report ("receipts") from this machine's local session transcripts — for justifying Claude Code usage/spend to a manager, self-review, or "what have I been using this for" check-ins. Mines ~/.claude/projects locally (no extra API calls beyond one final write-up), cross-references local git history, and writes a markdown report plus a self-contained HTML receipt to your home directory. Use when the user asks for "receipts", an "impact report", "usage report", wants to "show my Claude Code activity", "prove the value of Claude Code", or runs `/receipts`.
tools
Generate and publish a project status artifact — an opinionated, tabbed status page for a project too big for one update (overview & success criteria, the workstream sequence, next steps, plus background, plan, risks & open questions, and decisions/FAQ when they earn a tab) — published with the built-in Artifact tool to a default-private claude.ai page the user can share with teammates. Use when a piece of work spans several workstreams and you want a shareable overview kept current. Each artifact is backed by a small per-project config in the plugin data dir, so refreshing it re-gathers live state, redeploys the same URL, and reports only the delta. For software projects whose workstreams are PRs, also read swe.md (the X.Y PR-numbering convention; pulling PR state with gh/git; a per-PR detail block). Needs the built-in Artifact tool (claude.ai login). Not for single-PR changes or public docs.
development
Guidance for distinctive, intentional visual design when building new UI or reshaping an existing one. Helps with aesthetic direction, typography, and making choices that don't read as templated defaults.