The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion of untrusted data from the user's desktop environment, which serves as a potential vector for indirect prompt injection.
Ingestion points: SKILL.md specifies the use of screenshot and app_screenshot tools to capture content from any active application on the user's computer.
Boundary markers: While the skill instructs the agent that captured content (e.g., window titles or document text) should not be interpreted as high-privilege user commands, there are no structural delimiters to isolate this untrusted data from the system prompt.
Capability inventory: The agent is granted capabilities including mouse clicks, keyboard input, and automated browsing, which could be exploited if the agent follows malicious instructions found on a captured screen.
Sanitization: The skill includes significant safety-oriented sanitization logic, such as the requirement to inspect full URLs before clicking and the enforcement of restricted access tiers (e.g., 'read' tier for browsers) to mitigate the impact of malicious data.

computer-use