The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from the user's screen history, which could be manipulated by external content (e.g., an attacker displaying malicious text on a webpage the user visits).
Ingestion points: Captured OCR text and window titles are fetched from the local Screenpipe API in scripts/fetch_window.py.
Boundary markers: The prompt template in scripts/synthesize.py interpolates capture data directly; while it uses instructions for the LLM, it lacks robust delimiters to prevent embedded instructions in the screen data from being followed by the model.
Capability inventory: The skill can write files to the local system (scripts/run.py writes draft skills) and relocate directories (scripts/promote.py), which could be abused if an injection succeeds in generating a malicious skill that the user subsequently promotes.
Sanitization: A redaction module in scripts/redact.py utilizes regex patterns to strip common secrets and PII (emails, JWTs, API keys for various vendors, private keys) from the data before LLM processing.
[DATA_EXFILTRATION]: The skill transmits summaries of screen activity to external LLM providers, including Anthropic and user-configured Foundry gateways.
While this is the intended purpose of the skill, it involves reading sensitive screen content and sending it over the network. The risk is significantly reduced by the local clustering logic and the mandatory PII redaction performed in scripts/redact.py before egress.

autoskill