The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill captures and processes desktop UI data, including window titles and element text, which could contain malicious instructions designed to influence the agent's behavior.
Ingestion points: UI data is ingested via ad_snapshot, ad_get_tree_exact, and ad_last_error_details() within SKILL.md and references/error-handling.md.
Boundary markers: The documentation mentions redacting sensitive fields in logs, but does not specify delimiters for UI-sourced text processed by the agent.
Capability inventory: The skill allows for comprehensive desktop interaction including clicking, typing (ad_execute_by_ref), and window management.
Sanitization: Log events have sensitive fields replaced with {"redacted":true}.
[DYNAMIC_EXECUTION]: The skill uses FFI (Foreign Function Interface) to dynamically load and execute functions from a compiled library (libagent_desktop_ffi). The Python examples in references/build-and-link.md use ctypes.CDLL to interface with this binary code.
[COMMAND_EXECUTION]: The documentation includes instructions for building the library from source using cargo build --profile release-ffi -p agent-desktop-ffi in SKILL.md and references/build-and-link.md.
[DATA_EXFILTRATION]: The ad_last_error_details() function provides access to structured JSON context which may include sensitive information from the user's screen, such as window titles and element values. The skill documentation in references/error-handling.md explicitly instructs developers to treat this as sensitive data and avoid routing it to shared logs.

agent-desktop-ffi