The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses subprocess.run to call the macOS osascript utility, enabling the execution of arbitrary AppleScript code on the host machine. This gives the agent broad control over the local desktop environment.
Evidence: run.py executes subprocess.run(["osascript", "-e", script], ...) within the run_script function.
[DYNAMIC_EXECUTION]: The skill dynamically generates AppleScript commands by interpolating agent-provided strings into code templates at runtime.
Evidence: The open_app function in run.py constructs a command using f-strings: f'tell application "{app}" to activate'. This allows for AppleScript logic injection if the app variable contains malicious AppleScript syntax (e.g., using quotes and comments to break out of the intended command).
[INDIRECT_PROMPT_INJECTION]: The skill serves as a system-level execution engine. If an attacker provides malicious data that is processed by the agent and passed as arguments to this skill, it could lead to the execution of harmful scripts on the user's system.
Ingestion points: The script and app arguments in run.py are sourced from the agent's context.
Boundary markers: None are implemented; the skill executes the generated script directly.
Capability inventory: Access to macOS osascript, which can control all installed applications, interact with the file system, and execute shell commands via AppleScript's do shell script feature.
Sanitization: No escaping, validation, or sanitization is performed on the input strings before they are passed to the system command.

desktop-automation