The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes session data that may originate from untrusted external sources, such as website content or file reads provided by other tools. This creates an attack surface where malicious instructions could be extracted as fragments and placed on the user's clipboard for potential execution.
Ingestion points: The scan window includes assistant messages in SKILL.md which often contain output from external tools (web search, file reading).
Boundary markers: The instructions do not specify the use of delimiters or specific markers to isolate or escape the extracted content during the process.
Capability inventory: The skill has the ability to write to the local filesystem (scratchpad directory) and modify the system clipboard history via the scripts/clip.sh script.
Sanitization: While the skill performs structural cleaning (stripping markdown fences, prompts, and line numbers), it does not validate the safety or intent of the extracted commands or URLs.
[COMMAND_EXECUTION]: The scripts/clip.sh script executes several shell utilities including pbcopy, osascript, textutil, perl, and hexdump. These are used to manage clipboard flavors and history. While the inputs are handled via files and hex-encoding, it represents a local command execution surface.
[DATA_EXFILTRATION]: The skill instructions in SKILL.md include a rule to skip secrets like tokens, passwords, and private keys. However, this safety measure is explicitly bypassed if the user's hint "asked for them by name." This design allows a potential path for sensitive session data to be moved from the agent's private context to the shared system clipboard history.
[DYNAMIC_EXECUTION]: The scripts/clip.sh script dynamically generates AppleScript code via printf to set the clipboard with multiple data flavors (HTML, RTF, UTF-8). The generated script is then executed using osascript -. Although the payload is hex-encoded to prevent string injection, the runtime generation and execution of scripts is a dynamic execution pattern.

p-clipboard-copy