The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it processes untrusted data from the user's screen capture history and uses an LLM to synthesize new skill instructions.
Ingestion points: scripts/fetch_window.py retrieves OCR text and window titles from the local screenpipe HTTP API.
Boundary markers: The prompt construction in scripts/synthesize.py does not use explicit delimiters or 'ignore embedded instructions' warnings when passing observed data to the LLM.
Capability inventory: The skill uses Read, Write, Edit, and Bash tools to create, modify, and promote files within the agent's skill library.
Sanitization: scripts/redact.py provides robust regex-based redaction of PII (emails, phone numbers) and credentials (API keys, tokens) before data is sent to the LLM, but it does not sanitize against instructional content that might influence the LLM's synthesis logic.
[DATA_EXFILTRATION]: The skill reads highly sensitive local data (everything on the user's screen). While it defaults to a local LLM backend (LM Studio) and provides PII redaction, an optional cloud backend (Claude) is available which would involve sending redacted summaries to an external service.
[COMMAND_EXECUTION]: The skill utilizes the Bash tool in scripts/doctor.py and scripts/autoskill.py to perform system diagnostics, verify dependencies like the screenpipe daemon, and manage the promotion of drafted skills into the production environment.

autoskill