The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides extensive instructions for executing arbitrary system commands through osascript and the do shell script command within AppleScript. This includes the ability to launch processes, simulate keyboard/mouse input, and manipulate system settings.
[COMMAND_EXECUTION]: The documentation explicitly details how to execute commands with administrator privileges (sudo), which facilitates privilege escalation. While often necessary for system-level automation, this capability allows for high-impact actions if the agent is misled or compromised.
[DATA_EXFILTRATION]: The skill documents methods to access sensitive user information, including reading the system clipboard, retrieving email contents from Mail, accessing contact details from Contacts, and reading messages from Messages. This creates a high risk of sensitive data exposure.
[PROMPT_INJECTION]: The skill exposes a significant surface for indirect prompt injection by providing the means to ingest untrusted data from external sources.
Ingestion points: The agent can read web page content via source of current tab in Safari and email body text via content of message in Mail.
Boundary markers: The instructions do not define boundary markers or delimiters to separate untrusted external content from agent instructions.
Capability inventory: The skill allows full file system access, network requests via shell commands (curl/wget), and UI automation via System Events.
Sanitization: There are no provided mechanisms for sanitizing or escaping the content retrieved from browsers or mail clients before it is processed by the agent.
[EXTERNAL_DOWNLOADS]: The documentation suggests installing external utilities via Homebrew (brew install) such as blueutil, switchaudio-osx, and fswatch to extend automation capabilities.

macos-osascript