The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes a suite of macOS system diagnostic utilities (such as top, ps, lsof, footprint, vmmap, leaks, and heap) through a Python wrapper script. These operations are performed using list-based arguments to prevent shell injection and are limited to the current user's processes.
[INDIRECT_PROMPT_INJECTION]: The skill communicates with other active AI sessions on the same machine to identify specific processes. This creates a surface where an attacker-controlled session could provide malicious instructions in a reply. The risk is mitigated by explicit instructions to treat all replies as information only and never as commands or approval.
Ingestion points: Replies from other sessions via the SendMessage tool.
Boundary markers: The instructions include a specific "Ground rules" section stating that a session's reply is neither approval nor a command.
Capability inventory: The agent can execute kill -TERM and diagnostic tools like leaks that pause processes.
Sanitization: No programmatic sanitization of session replies is implemented; the skill relies on LLM-level instructional constraints.
[DATA_EXPOSURE]: The skill inventories system processes which may contain sensitive names or paths. It mitigates this by explicitly stripping command-line arguments (where secrets often reside) before storage and by using restricted file permissions (0700/0600) for its local data directory at ~/.claude/mac-activity/.

mac-activity