The Agent Skills Directory

[DATA_EXFILTRATION]: The skill provides access to tools that read sensitive local data, including the system clipboard (local.clipboard.get), contacts (local.contacts.search), and unread messages (local.mail.unread). It also includes actions capable of sending data externally, such as local.mail.send and local.browser.open. This combination of read and write capabilities creates a potential path for data exfiltration if the agent's logic is compromised.
[COMMAND_EXECUTION]: The skill uses local.apps.launch and local.apps.quit, which allow the agent to start or stop arbitrary applications on the host macOS system. This grants the agent significant control over the local execution environment.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it reads untrusted data from external sources (like emails or browser content) and has powerful local capabilities. An attacker could send a malicious email that, when read by the agent, triggers unauthorized local commands or data theft.
Ingestion points: local.mail.unread, local.browser.tabs, local.clipboard.get.
Boundary markers: None mentioned in instructions to separate untrusted data.
Capability inventory: local.apps.launch, local.mail.send, local.finder.open, local.browser.open.
Sanitization: No explicit instructions for sanitizing or escaping external content before processing.

local-access