The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The scripts keyboard.py, mouse.py, and screen.py all include an ensure_pyautogui() function that automatically executes pip install pyautogui. This behavior downloads and installs code from the Python Package Index (PyPI) at runtime without user intervention or explicit dependency lockfiles.
[DYNAMIC_EXECUTION]: The screen.py script utilizes osascript to execute dynamically generated AppleScript. This script traverses the system's accessibility tree to extract UI information, which is a powerful and invasive method of interacting with the operating system.
[COMMAND_EXECUTION]: The skill makes extensive use of subprocess.run to execute shell commands, including package installers (pip), clipboard managers (pbcopy), and scripting hosts (osascript).
[PRIVILEGE_ESCALATION]: The skill explicitly instructs users to grant 'Accessibility' permissions to their terminal or IDE. These permissions allow the process to bypass standard application sandboxing, enabling it to monitor other applications and simulate system-wide input.
[INDIRECT_PROMPT_INJECTION]: The skill is highly vulnerable to indirect prompt injection because it reads raw text and UI metadata from the screen and allows the agent to take actions based on that data.
Ingestion points: scripts/screen.py reads titles, names, values, and descriptions of all UI elements in the frontmost application.
Boundary markers: None. The accessibility tree is returned as a plain text hierarchy without delimiters or instructions to ignore embedded commands.
Capability inventory: Full keyboard simulation (typing, hotkeys) via keyboard.py and mouse control (clicking, dragging) via mouse.py.
Sanitization: None. The UI element labels and values are processed without filtering or escaping.

desktop-control