The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from terminal PTY logs and screenshots captured from automated environments.
Ingestion points: The snapshot command (Linux), screenshot command (Linux), and shot commands (macOS/Windows) read output from terminal sessions and VM consoles into the agent's context.
Boundary markers: The documentation does not specify explicit delimiters or "ignore" instructions for the ingested terminal data, relying instead on the platform's isolated runtime directory or VM boundaries.
Capability inventory: The skill provides significant control over the environment, including keystroke injection (type, press), command execution (launch), and VM lifecycle management (up, down, kill).
Sanitization: While the Linux driver mentions a "scrubbed PTY log," the specific sanitization methods for removing potentially malicious escape sequences or embedded instructions are not detailed.
[COMMAND_EXECUTION]: The skill relies on external binaries and scripts provided by the Droid plugin ecosystem to interact with system-level services.
Evidence: Frequent use of ${DROID_PLUGIN_ROOT}/bin/tctl, mac-ctl.sh, and vm-ctl.sh to execute shell commands, manage sockets via socat, and interface with QEMU/virsh.
[PRIVILEGE_ESCALATION]: Setup instructions include commands requiring elevated permissions to install system dependencies.
Evidence: sudo apt-get install -y cage wtype grim wf-recorder in platforms/linux.md and requirements for libvirt/QEMU management on the host system.

true-input