The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses osascript to execute AppleScript for UI automation and screencapture to take screenshots of the system Find My application. This provides the agent with programmatic control over a system app and the ability to capture visual data.
[INDIRECT_PROMPT_INJECTION]: The skill processes screenshot data via a vision model. Because device or AirTag names are user-controllable and can be shared, an attacker could name a tracked item with a malicious prompt to influence the vision model's output or the agent's next steps.
[EXTERNAL_DOWNLOADS]: The skill recommends installing peekaboo from a third-party Homebrew tap (steipete/tap/peekaboo). While documented, this introduces an external dependency from a non-vendor source.
[DATA_EXPOSURE]: Screenshots containing sensitive location coordinates and addresses are saved to /tmp/, which is often world-readable or accessible to other local processes, potentially exposing private location data to other users on the system.

findmy