The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to generate instrumentation and automation scripts for iOS applications based on provided "source" code or runtime inspection data. This creates a surface for indirect prompt injection where malicious content within the analyzed application source or identifiers could influence the generated script's logic.
Ingestion points: The skill ingests a "requested runtime question" and "source" information (including accessibility identifiers, labels, UIViews, and Objective-C classes/selectors) as described in SKILL.md and references/driver-generation.md.
Boundary markers: The instructions do not explicitly require the use of delimiters or "ignore embedded instructions" warnings for the data extracted from the application source when generating code.
Capability inventory: The generated scripts have extensive capabilities including UI interaction via IOS.input, method hooking and replacement via Override, state snapshotting via Probe.evidence, and arbitrary native instrumentation via Frida Gum APIs (Direct Frida).
Sanitization: While references/critical-chain-evidence.md mentions that captured identifiers should be "sanitized", there is no instruction to sanitize or validate the input data used to construct the logic of the generated scripts, creating a risk that malicious source metadata could result in the generation of unintended or harmful script behavior.

to-ios-script