The Agent Skills Directory

[PERSISTENCE]: The skill's primary function is to modify agent configuration files (e.g., ~/.claude/settings.json, ~/.gemini/settings.json, ~/.codex/hooks.json) to execute local scripts during lifecycle events. This ensures that the skill's code is executed automatically every time the agent finishes a task or requires input.
[COMMAND_EXECUTION]: The skill executes a wide range of system commands across different platforms, including powershell.exe, /bin/sh, osascript, afplay, paplay, aplay, and notify-send. These tools are used to trigger system beeps, play audio files, and display desktop notifications.
[PRIVILEGE_ESCALATION]: Both the installation scripts (install-hooks.ps1, install-hooks.js) and the runtime hooks use the PowerShell -ExecutionPolicy Bypass flag. This allows the execution of unverified local scripts, bypassing default system security configurations.
[OBFUSCATION]: In scripts/hook-runner.ps1, the skill uses [Convert]::ToBase64String to encode a PowerShell command which is then executed via the -EncodedCommand parameter. While used here to manage background process spawning, this technique is frequently used to mask command intent from static analysis.
[DYNAMIC_EXECUTION]: The skill dynamically generates command strings and JSON configuration blocks that are written to agent settings files for later execution. In hook-runner.ps1, the command to launch the ring.ps1 script is constructed at runtime and executed as an encoded background process.
[INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface for indirect prompt injection as it ingests untrusted data from the agent's environment.
Ingestion points: scripts/hook-runner.js reads JSON from stdin (lines 66-78); scripts/hook-runner.ps1 reads raw input from the pipeline (lines 19-21).
Boundary markers: No specific boundary markers or instructions are used to prevent the agent from misinterpreting instructions embedded within the summary or message fields.
Capability inventory: The skill can spawn subprocesses, execute osascript (macOS), and run encoded PowerShell commands (Windows).
Sanitization: The skill uses Limit-Text to truncate strings to a maximum length (e.g., 180 or 240 characters) and performs basic string replacement for quotes, but does not robustly sanitize the content against command injection or notification-based phishing.

agent-doorbell