The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill provides recipes for a 'Debug bridge' using DistributedNotificationCenter and custom URL schemes. These mechanisms allow external processes or links to send commands to the application, creating a surface for indirect instruction injection.
Ingestion points: The recipes.md file defines DistributedNotificationCenter.default().addObserver for the notification name com.you.app.command and URL schemes handled via .onOpenURL or application(_:open:).
Boundary markers: The instructions do not suggest delimiters or boundary markers for content received through these external channels.
Capability inventory: The recipes include powerful capabilities such as file writing (status.json), window manipulation via Accessibility APIs (AXUIElement), and application logic execution via DebugBridge.run and WindowManager.run.
Sanitization: No sanitization, escaping, or validation logic is present in the provided code snippets to filter external commands.
[COMMAND_EXECUTION]: The skill instructs the agent to use the lsregister tool (located in /System/Library/Frameworks/CoreServices.framework/Frameworks/LaunchServices.framework/Support/) with the -trusted flag to refresh Launch Services and establish the application's trust status. While legitimate for macOS development, this involves direct execution of a powerful system utility.
[PERSISTENCE]: The skill implements persistence by providing instructions and code for 'Launch at login' using the ServiceManagement framework's SMAppService.mainApp.register() API, allowing the resulting application to automatically start across user sessions.

os-integrations