The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill provides tools for ingesting untrusted data through functions like get_clipboard and spotlight_search as described in SKILL.md. Malicious instructions embedded in clipboard contents or files could potentially be processed by the agent, leading to unintended behavior.
Ingestion points: The tools get_clipboard() and spotlight_search() in SKILL.md act as entry points for external, potentially untrusted content.
Boundary markers: The skill manifest does not define specific delimiters or instructions to treat ingested data as untrusted text.
Capability inventory: The skill allows for significant system interaction, including launching applications, executing AppleScript for app control, and modifying the clipboard (SKILL.md).
Sanitization: The author claims that AppleScript strings are sanitized and that a blacklist of dangerous keywords (e.g., sudo, rm) is enforced (SKILL.md).
[COMMAND_EXECUTION]: The skill provides a broad interface for executing system-level commands and scripts on the host macOS machine, such as controlling applications and system settings. While the documentation states that shell=True is not used, the extensive access to local system resources represents a notable attack surface if the agent's instructions are subverted.

mac-control