The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted OCR text and window titles retrieved from the local screenpipe service (fetch_window.py). This content is interpolated into the synthesis prompt for the LLM (synthesize.py) to generate new skill drafts. The current implementation lacks boundary markers or explicit instructions for the LLM to ignore potentially malicious commands embedded in the processed text.
Ingestion points: Raw OCR text and window titles are fetched from the screenpipe HTTP API in scripts/fetch_window.py.
Boundary markers: The _build_prompt function in scripts/synthesize.py does not utilize delimiters or specific instructions to isolate the untrusted cluster data.
Capability inventory: The skill has the capability to write new SKILL.md files to the filesystem (scripts/run.py) and move them into the main skills directory (scripts/promote.py).
Sanitization: While scripts/redact.py provides excellent protection against secret exposure (PII, API keys), it does not sanitize the input for natural language instructions intended to influence the LLM's output.
[EXTERNAL_DOWNLOADS]: The skill automatically fetches a machine learning model from a well-known public repository during its first execution.
Evidence: scripts/run.py initializes SentenceTransformer("sentence-transformers/all-MiniLM-L6-v2"), which triggers a download of the model weights (~80MB).
[COMMAND_EXECUTION]: The skill uses filesystem operations to manage proposed and promoted skills.
Evidence: scripts/promote.py uses shutil.move to relocate user-approved skill drafts into the permanent skills directory.

autoskill