The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from the target iOS application during the vision-driven agent loop, which presents an indirect injection surface.
Ingestion points: The agent ingests application metadata and UI hierarchy data from the /elements endpoint and visual state from the /screenshot endpoint in StateServer.swift.template.
Boundary markers: Absent. The agent is instructed to analyze the screens directly to decide on subsequent actions.
Capability inventory: The agent has access to a wide range of sensitive tools including Bash, Write, Edit, Grep, and Read as specified in SKILL.md.
Sanitization: The daemon includes a sanitizeReplacer in daemon/src/audit.ts that filters malformed UTF-16 surrogate pairs to ensure API stability, though it does not perform semantic filtering of the ingested app data.
[DYNAMIC_EXECUTION]: The skill performs runtime generation of Swift source code (StateAccessor.swift) based on the application's observable properties. This generated code is automatically compiled and linked into the user's application via xcodebuild during the bootstrap phase to establish the debug bridge.
[EXTERNAL_DOWNLOADS]: The skill's code generation tool defines a dependency on the swift-syntax package, which is fetched from Apple's official swiftlang organization on GitHub.

ios-qa