The Agent Skills Directory

[COMMAND_EXECUTION]: The skill makes extensive use of osascript, python3, and swift to execute dynamic code blocks on the host system. This is used for automation tasks, materializing iCloud files, and modifying system state.
Evidence: Heredoc execution in references/icloud-dataless-files.md (Swift) and references/notes-creation-date-count.md (AppleScript).
Persistence: The skill suggests modifying the user's shell profile (~/.zshrc) and installing Chrome native messaging hosts in ~/Library/Application Support/ to maintain specific behaviors or fixes across sessions.
[PROMPT_INJECTION]: The skill represents an indirect prompt injection surface because it is designed to read and process untrusted content from external sources.
Ingestion points: Reads message bodies from Apple Mail and content from Apple Notes.
Boundary markers: No explicit delimiters or instructions to ignore embedded commands are used when interpolating this data.
Capability inventory: The agent has the ability to execute shell commands, run AppleScript, and perform GUI automation via cua-driver.
Sanitization: No sanitization or validation of the ingested email/note content is mentioned before processing.
[DATA_EXFILTRATION]: The skill has read access to sensitive user data, including personal emails in Apple Mail and private records in Apple Notes. While it includes safety warnings against requesting passwords, the access to these databases represents a data exposure risk.
[EXTERNAL_DOWNLOADS]: The documentation describes downloading external software, specifically Google Chrome for Testing, using the @puppeteer/browsers utility.

macos-app-automation