The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's primary function involves analyzing OCR text and window titles captured from the user's screen. If an attacker can control what is displayed on the screen (e.g., via a malicious website, document, or email), they could potentially embed instructions designed to manipulate the LLM during the synthesis phase in scripts/synthesize.py.
Ingestion points: Data enters the system via scripts/fetch_window.py, which queries the local screenpipe HTTP API.
Boundary markers: The LLM prompt template in scripts/synthesize.py lacks robust delimiters or explicit instructions for the model to ignore potential commands embedded within the cluster summaries.
Capability inventory: The skill allows the Bash tool and uses scripts/promote.py to move generated skills into the active skills directory, potentially operationalizing a malicious draft.
Sanitization: While scripts/redact.py effectively scrubs secrets and PII, it does not sanitize instructional content that could trigger an injection attack.
[DATA_EXFILTRATION]: The skill reads highly sensitive screen-capture history. Although it implements significant mitigations, it provides a pathway for data to leave the local environment.
Sensitive Data Access: Accesses the screenpipe API, which contains a record of all visible screen content.
Mitigations: It defaults to a local LLM backend (LM Studio) and provides a comprehensive redaction script (scripts/redact.py) that filters private keys, API tokens (OpenAI, Anthropic, Slack, etc.), JWTs, and bearer tokens before data is summarized.
Network Safety: scripts/backends.py includes a check_remote_endpoint function that actively blocks sending screen summaries or API keys over plaintext HTTP to any host other than localhost.
[COMMAND_EXECUTION]: The skill is authorized to use the Bash tool and is designed to generate and install new skills that contain executable logic.
Drafting and Promotion: scripts/synthesize.py generates new SKILL.md files, and scripts/promote.py uses shutil.move to place them into the active skills directory. The synthesize.py script includes path traversal protection to ensure generated skill names remain within the designated directory.
[EXTERNAL_DOWNLOADS]: The skill leverages the sentence-transformers library, which downloads a local embedding model (all-MiniLM-L6-v2) from Hugging Face on its first run to facilitate local skill matching.

autoskill