The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill instructions mandate that the agent fetch and prioritize documentation from a remote repository (github.com/hereisderek/StageDroid/SKILL.md). This creates a dependency on external content that the agent is instructed to treat as "authoritative," representing a surface for indirect prompt injection if the remote content is compromised.
Ingestion points: scripts/device-check.sh fetches SKILL.md from GitHub and discovery data from StageDroid servers.
Boundary markers: The skill lacks explicit boundary markers or instructions to ignore embedded commands in the fetched documentation.
Capability inventory: The skill utilizes adb for device shell access, curl for network requests, and gradlew for local code execution.
Sanitization: No sanitization or validation of the remote Markdown content is performed before presenting it to the agent.
[CREDENTIALS_UNSAFE]: The device-wake-unlock.sh script facilitates the storage of Android device passcodes in a local JSON file (~/.config/android-skill-derek/devices.json). While the script applies restrictive filesystem permissions (0600), this constitutes a local store of sensitive authentication data.
[EXTERNAL_DOWNLOADS]: The skill performs several network operations to discover services and update its capabilities.
Evidence: scripts/device-check.sh uses curl to query the GitHub API and raw content domains, as well as local/remote StageDroid endpoints (/api/discovery, /status).
[COMMAND_EXECUTION]: The skill scripts execute multiple local commands that interact with the host system and connected devices.
Evidence: Usage of adb to execute shell commands on devices (wm size, input keyevent, uiautomator dump), and execution of the project's build system (./gradlew installDebug) in device-verify-gate.sh.

state-droid-remote-device