The Agent Skills Directory

[DATA_EXFILTRATION]: The skill accesses sensitive data sources on the host system to perform its functions. While intended for clipboard management, this provides the agent with access to potentially confidential information.
Evidence: The script pasteboard_monitor.swift polls NSPasteboard.general, which contains the current system clipboard content.
Evidence: The script export_maccy_history.py reads directly from the Maccy SQLite database at ~/Library/Containers/org.pavelm.Maccy/Data/Library/Application Support/Maccy/Storage.sqlite, which contains the user's entire clipboard history.
[COMMAND_EXECUTION]: The skill uses system commands to interact with application state and diagnostic information.
Evidence: Uses ioreg -l -w 0 to inspect macOS Secure Input status.
Evidence: Uses sqlite3 to perform direct deletions or queries on the application's CoreData store.
Evidence: Uses defaults to read or reset application preferences.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data originating from the system clipboard, which could contain malicious instructions designed to influence the agent.
Ingestion points: NSPasteboard (via Swift monitor) and Storage.sqlite (via Python exporter) in SKILL.md and gpt.md.
Boundary markers: Absent. The scripts do not use delimiters or instructions to prevent the agent from obeying text found in the clipboard.
Capability inventory: Includes file system writes, preference modification, and database manipulation.
Sanitization: The Swift script in SKILL.md includes a basic filter for specific password manager metadata types, but no sanitization for prompt injection is implemented.

maccy