The Agent Skills Directory

[COMMAND_EXECUTION]: The skill makes extensive use of subprocess.run to interact with system utilities such as powershell.exe, osascript, cliclick, xdotool, and maim for cross-platform desktop automation. These operations are core to the skill's intended functionality.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted desktop content and transcripts, creating a surface for indirect prompt injection attacks. 1. Ingestion points: Screenshots captured by screenctl.py and transcripts read by session_watch.py. 2. Boundary markers: The skill documentation in SKILL.md (Rule 5) explicitly warns the agent to treat all screen content as untrusted input. 3. Capability inventory: The skill possesses high-privilege capabilities including typing, clicking, and shell execution. 4. Sanitization: Mitigation is provided through identity-based window focus verification in screenctl.py and a regex-based REFUSE list for shell commands in autodrive.py.
[REMOTE_CODE_EXECUTION]: Automated scans detected remote execution patterns (e.g., curl | bash); however, these are located within a hardcoded REFUSE list in scripts/autodrive.py and its test suite scripts/_test_autodrive.py. These patterns are used to identify and block dangerous commands during automated agent sessions.
[PRIVILEGE_ESCALATION]: Patterns for privilege escalation (e.g., sudo, chmod 777) were identified within the skill's defensive refuse list and test suites, serving as a safeguard against unauthorized operations.

drive-screen