The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests data from external agent hooks (e.g., Claude Code, Codex) which could potentially contain malicious instructions if the agent is processing untrusted content.
Ingestion points: bin/claude_hook.py and bin/codex_hook.py read hook events directly from stdin.
Boundary markers: Inputs are processed using structured JSON parsing.
Capability inventory: The daemon bin/cockpitd.py executes local commands, but only those explicitly predefined in the user's cockpit.json configuration file. It does not accept arbitrary command fragments or shell strings from the API or hooks.
Sanitization: Hook inputs are mapped to a fixed set of semantic states (e.g., 'running', 'idle', 'needs_attention'). Descriptive labels and details are length-limited and used for display only, having no influence on logic or command execution.
[DYNAMIC_EXECUTION]: The skill generates and executes AppleScript and PowerShell code at runtime to facilitate interaction with terminal emulators and OS UI elements.
Evidence: bin/focus_terminal.py, bin/focus_tmux.py, and bin/windows_terminal_uia.ps1 construct script strings dynamically for execution via osascript or powershell.exe.
Mitigation: Interpolated variables, such as session names and tab titles, are strictly validated against regular expressions (e.g., ^[A-Za-z0-9_.-]{1,80}$) before being embedded. Scripts are executed using subprocess.run(shell=False) with arguments passed properly to the interpreters, preventing injection attacks.
[EXTERNAL_DOWNLOADS]: The build and validation process for the Stream Deck plugin involves standard network operations to fetch rules from the hardware vendor.
Evidence: The npm run validate step in streamdeck-plugin/package.json invokes the official Elgato validator, which may download current rulesets.
Mitigation: These operations are targeted at well-known, trusted vendor infrastructure and are documented in the skill's README files.
[COMMAND_EXECUTION]: The core functionality of the skill involves executing local CLI tools (tmux, terminal agents, etc.) via a central daemon.
Evidence: bin/cockpitd.py features a CommandRunner that handles execution using subprocess.run and subprocess.Popen.
Mitigation: The daemon explicitly rejects shell command strings (bash -c, etc.) and requires all commands to be supplied as fixed argv arrays. It uses random, file-backed bearer tokens and binds only to the local loopback interface by default to prevent unauthorized access.

streamdeck-agent-cockpit