The Agent Skills Directory

[PERSISTENCE]: The script scripts/prompt_scheduler.py creates macOS LaunchAgents by writing plist files to ~/Library/LaunchAgents/. These files are configured to trigger a wrapper script at a specific calendar interval, allowing code to execute automatically outside of the active agent session. Although the wrapper script attempts to delete the plist after execution, the capability to create startup items constitutes a persistence mechanism.
[COMMAND_EXECUTION]: The skill executes various system utilities and arbitrary user-provided commands.
The Python script uses subprocess.run to invoke launchctl for job management, open for application launching, and plutil for validation.
It generates .command files that execute shell commands using exec /bin/zsh -lic, which runs the command within a new interactive shell environment.
[INDIRECT_PROMPT_INJECTION]: The skill's workflow involves extracting and scheduling commands directly from user prompts, which creates a surface for indirect prompt injection if the agent processes untrusted external data containing malicious commands.
Ingestion points: Commands and scheduling parameters are extracted from the user's natural language input as described in SKILL.md.
Boundary markers: The skill does not define specific delimiters or instructions to ignore embedded commands within the processed text.
Capability inventory: The skill possesses file-write capabilities for scripts and plists, and process execution capabilities via launchctl and zsh.
Sanitization: The script uses shlex.quote to escape command strings before writing them into generated shell scripts, which helps prevent simple command injection into the scheduler's own logic but does not prevent the scheduling of a malicious command itself.

prompt-scheduler