The Agent Skills Directory

[METADATA_POISONING]: The skill includes a file named .security-scan-passed which contains a hardcoded claim of safety ("Security scan passed"). This is a deceptive pattern intended to mislead automated security tools and reviewers by asserting a safety verdict that was not independently verified.
[PERSISTENCE_MECHANISMS]: The skill is designed to create persistent background processes on macOS using launchd (LaunchAgents and LaunchDaemons). The scripts/new-launchagent.sh script automates the installation of these persistence mechanisms, which allows code to execute automatically at user login or system boot.
[PRIVILEGE_ESCALATION]: The installation script scripts/new-launchagent.sh requires and utilizes sudo (administrative privileges) when installing system-wide LaunchDaemons or creating directories in protected system paths like /Library/LaunchDaemons and /Library/Logs.
[INDIRECT_PROMPT_INJECTION]: The scripts/new-launchagent.sh script generates .plist configuration files by interpolating user-provided command-line arguments. The script lacks robust sanitization of these arguments, which could allow for XML tag injection to insert unauthorized configuration keys or commands into the persistence file.
Ingestion points: Command line arguments $LABEL, $PROGRAM, and $EXTRA_ARGS in scripts/new-launchagent.sh.
Boundary markers: Absent. User input is directly wrapped in XML tags within a heredoc.
Capability inventory: File system modification (mkdir, mv) and process management (launchctl bootstrap) with potential root privileges.
Sanitization: Incomplete. While basic regex validation exists for labels and intervals, there is no XML escaping for the program path or additional arguments.
[EXTERNAL_DOWNLOADS]: The evaluation fixture evals/iteration-1/eval-2-audit/fixture/broken-heal.sh performs a network request to Google's official domain (https://www.googleapis.com/generate_204) using curl to verify internet connectivity. This targets a well-known service and represents a standard connectivity check.

macos-watchdog