The Agent Skills Directory

[COMMAND_EXECUTION]: The skill invokes a wide range of macOS system utilities to manage VM lifecycles and disk images. This includes osascript for AppleScript automation, utmctl for CLI operations, hdiutil for mounting and creating disk images, rsync for file synchronization, and wimlib-imagex for WIM manipulation. It also uses nc and ssh for network verification and guest access.
[INDIRECT_PROMPT_INJECTION]: The skill processes data originating from guest virtual machines through commands like utmctl exec, utmctl file pull, and AppleScript's execute vm function. This creates an attack surface where a compromised or malicious guest VM could provide output containing instructions intended to manipulate the host agent's behavior.
Ingestion points: utmctl exec, utmctl ip-address, utmctl file pull, and AppleScript execute command results.
Boundary markers: No specific delimiters or "ignore instructions" warnings are defined for processing guest output.
Capability inventory: The skill possesses file writing (utmctl file push), arbitrary command execution on the host (osascript), and network operations.
Sanitization: No explicit sanitization or validation of guest-provided data is mentioned.
[DYNAMIC_EXECUTION]: The skill uses dynamic execution patterns to perform system-level tasks. Specifically, it employs osascript -e for ad-hoc AppleScript execution and pipes inline scripts to python3 to modify config.plist files, which are used to bypass limitations in the standard AppleScript dictionary for UTM.
[DATA_EXPOSURE]: The instructions direct the agent to read local application configuration files (e.g., UTM's config.plist) and system files like /var/db/dhcpd_leases to retrieve VM details and IP addresses. It also references ~/.ssh/id_ed25519 within documentation examples for configuring SSH access to guests.

utm