The Agent Skills Directory

[COMMAND_EXECUTION]: The skill relies on the osascript tool to execute AppleScript, which includes the do shell script functionality. This allows the AI agent to execute arbitrary shell commands on the host machine.
[DATA_EXFILTRATION]: The skill provides templates to access highly sensitive information, including reading unread emails in the Mail app, accessing calendar events, retrieving system clipboard contents, and listing files in the user's home directory. These capabilities, combined with the ability to send emails or automate a web browser (Safari), create a high-risk data exfiltration vector.
[REMOTE_CODE_EXECUTION]: By providing a generalized execution wrapper for AppleScript, the skill functions as a local code execution engine, allowing the agent to perform complex operations on the operating system that exceed typical AI task boundaries.
[PROMPT_INJECTION]: The skill contains a 'Self-Improvement Protocol' in SKILL.md that instructs the agent to use its 'Edit' tool to modify the skill's own reference files (references/*.md). This self-modification capability is a critical vulnerability that could be exploited by an attacker (e.g., via a malicious email read by the agent) to inject persistent, unauthorized instructions into the agent's core knowledge base.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection (Category 8) because it ingests untrusted data from emails, the clipboard, and web pages without boundary markers or sanitization logic. Evidence chain:
Ingestion points: references/mail-applescript.md (Mail content), examples/quick-note.applescript (Clipboard), references/safari-applescript.md (JavaScript results from web pages).
Boundary markers: Absent. No instructions are provided to the agent to ignore or delimit embedded commands within processed data.
Capability inventory: Full shell access via osascript, file system manipulation via Finder, and email transmission via Mail.
Sanitization: Absent. The skill lacks programmatic filtering or validation for external data before processing it.

mac-automation