The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted metadata from desktop environments, which serves as a potential vector for indirect prompt injection. * Ingestion points: The skill reads process lists, window titles, accessibility labels, and output from local CLI/API control planes (SKILL.md). * Boundary markers: The skill does not define specific delimiters or instructions for the agent to ignore embedded commands in the metadata. * Capability inventory: The skill possesses the ability to execute shell commands like screencapture and repository startup scripts, and interacts with local network sockets. * Sanitization: No explicit procedures for sanitizing or escaping external application data are described in the workflow.
[COMMAND_EXECUTION]: The skill relies on shell command execution to perform its core functions of evidence collection and application management. * Evidence: Instructions include running screencapture on macOS and identifying startup scripts within repositories such as npm run tauri dev (SKILL.md, references/usage.md). * Mitigations: The skill mandates preflight checks and strictly prohibits the use of generic evaluation or shell bridges to maintain a controlled execution environment.

ops-client