The Agent Skills Directory

[COMMAND_EXECUTION]: The skill's fundamental purpose is to enable the agent to execute arbitrary shell commands via the wsh interface. This includes high-risk operations such as filesystem modifications (rm), package management (npm install), and system state changes. While the skill includes instructions for dry-runs and human confirmation, the technical capability for unrestricted execution is inherent.
[CREDENTIALS_UNSAFE]: The documentation explicitly instructs the agent on how to detect and respond to sensitive interactive prompts such as Password: or Enter passphrase:. This creates a risk where a malicious script or program could display a fake password prompt to harvest credentials from the agent or the user context it operates within.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection (Category 8). The agent is instructed to read terminal output and scrollback to decide its next actions.
Ingestion points: Untrusted data enters the agent context via wsh_get_screen or scrollback reads of command outputs (SKILL.md, "Reading the Result").
Boundary markers: There are no instructions provided to treat terminal output as untrusted or to ignore embedded natural language commands within that output.
Capability inventory: The agent has full shell access, including the ability to send any string as input to the terminal.
Sanitization: No sanitization or validation of screen content is mentioned before the agent uses it for decision-making.

drive-process