The Agent Skills Directory

[COMMAND_EXECUTION]: The skill invokes osascript in SKILL.md to programmatically set the frontmost application process, which requires macOS Accessibility permissions. It also uses the screencapture system utility in scripts/screenshot.sh to take images of specific window IDs.
[DYNAMIC_EXECUTION]: In scripts/screenshot.sh, the skill uses swiftc to compile a Swift source file (winid.swift) at runtime. Furthermore, SKILL.md contains multiple instances where js_eval is used to execute dynamically constructed JavaScript within the application's execution environment.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the application's DOM via tools like dom_query, dom_html, and js_eval (Ingestion Points). There are no delimiters or boundary markers present in the scripts to help the agent distinguish between UI data and instructions (Boundary Markers). The skill has access to sensitive capabilities such as screen capture, AppleScript focus control, and arbitrary JavaScript execution (Capability Inventory). No sanitization or filtering logic for the ingested DOM content is observed (Sanitization).
[DATA_EXFILTRATION]: Through the screenshot.sh script, the skill provides a mechanism to capture and store the visual state of the native application window. If the audited application displays sensitive data such as credentials or private information, this data is exposed to the agent and recorded to the local filesystem.

desktop-ui-audit