The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The README.md file contains installation commands that download scripts from the internet and immediately execute them with shell privileges. These patterns bypass integrity checks and are a primary vector for remote code execution.
Evidence: /bin/bash -c "$(curl -fsSL https://cua.ai/driver/install.sh)" in README.md
Evidence: irm https://cua.ai/driver/install.ps1 | iex in README.md
[EXTERNAL_DOWNLOADS]: The skill instructs the agent to download and install components from unverified third-party sources and specific git branches.
Evidence: clawhub install @cua/driver in README.md
Evidence: cua-driver skills install --from main in README.md
[COMMAND_EXECUTION]: The skill's primary function involves the agent constructing and executing shell commands for the cua-driver CLI, which presents a significant command injection surface if inputs from the user or environment are not perfectly sanitized.
Evidence: Instructions for executing cua-driver <tool-name> '<JSON-args>' throughout SKILL.md and platform-specific guides.
[DATA_EXFILTRATION]: The skill provides tools and instructions for the agent to access and record highly sensitive system data, including screen activity, clipboard contents, and user interaction history.
Evidence: RECORDING.md describes the capture of screen activity to MP4 video and structured JSON/PNG turn data.
Evidence: clipboard_read tool mentioned in SKILL.md.
Evidence: history_query and history_status tools in SKILL.md for accessing prior activity.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted data from applications and web pages, which could contain malicious instructions designed to subvert the agent's behavior.
Ingestion points: Data is ingested via get_window_state (accessibility trees and screenshots in SKILL.md), get_browser_state (DOM and page content in BROWSER.md), and clipboard_read (clipboard content in SKILL.md).
Boundary markers: BROWSER.md contains a textual warning to treat page content as untrusted, but no programmatic delimiters or safety-instruction reinforcement is used in the tool calls.
Capability inventory: The agent has broad capabilities to interact with the host GUI, including clicking, typing, dragging, and executing processes via launch_app.
Sanitization: There is no evidence of input validation or sanitization for the external data being processed.

cua-driver