The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/vmscript.py uses subprocess.run to execute the local node binary with the --check flag. This is used to validate the syntax of a userscript before it is written to the sync directory, which is a defensive measure to prevent corruption.
[DATA_EXPOSURE]: The skill identifies and accesses files within cloud storage directories such as ~/Dropbox/Apps/Violentmonkey, ~/OneDrive/Apps/Violentmonkey, and ~/Google Drive/*/Violentmonkey. While these are sensitive locations, the skill targets only the application-specific data necessary for its primary purpose of userscript synchronization.
[INDIRECT_PROMPT_INJECTION]: The skill serves as a mechanism for an agent to modify userscript code, which introduces an indirect injection surface if the inputs are malicious.
Ingestion points: The cmd_put function in scripts/vmscript.py reads userscript code from a local file provided as an argument.
Boundary markers: The skill operates as a standalone CLI tool; prompt-level boundary markers are not applicable to the script's logic.
Capability inventory: The skill has the capability to write JSON and JavaScript files to cloud-synced directories and execute local syntax checks.
Sanitization: The skill includes a syntax_check function that prevents writing the code if node --check returns a non-zero exit status, ensuring that only valid JavaScript is synced.

p-violentmonkey-userscript-sync