The Agent Skills Directory

[DATA_EXFILTRATION]: The skill accesses sensitive local application directories including ~/Library/Application Support/orca/ and ~/.claude/projects/. These locations contain session history, metadata, and potentially sensitive code fragments or transcript data from other agent sessions.
[COMMAND_EXECUTION]: Uses several system utilities to gather status data, including ps, lsof, ls, and git. It specifically utilizes caffeinate -u -t 4 to programmatically wake the system display, which is a system-level state modification used to facilitate screen captures.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external log files and JSON telemetry populated by other processes or previous sessions. This creates a surface where malicious content embedded in those logs could influence the agent's behavior during analysis.
Ingestion points: ~/Library/Application Support/orca/agent-hooks/last-status.json, ~/Library/Application Support/orca/terminal-history/.../output.log, and ~/.claude/projects/**/*.jsonl.
Boundary markers: No delimiters or instructions to ignore embedded content are specified when reading these files.
Capability inventory: Shell execution (ps, lsof, git, caffeinate), file system read access, and display capture capability (computer_use).
Sanitization: No sanitization, escaping, or validation of the log content is performed before the agent processes the information.

desktop-agent-activity