The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands using curl to interact with a remote or local phone agent. This involves the use of environment variables such as $HOST and $AUTH to authenticate and direct network requests.
Evidence: curl -s -H "$AUTH" "$HOST/agent/screenshot" -o issue-03.png and curl -s -H "$AUTH" "$HOST/agent/elements" > issue-03-elements.json.
[DATA_EXPOSURE]: The skill is designed to capture element trees and screenshots from a user's physical device. This data can contain PII, private messages, or credentials visible on the screen. While the skill includes 'Consent rules' (e.g., 'Never pay', 'Do not type into chats'), the capture process itself exposes sensitive environment data to the agent's context.
Evidence: Capture of issue-03.png and issue-03-elements.json in the run folder.
[INDIRECT_PROMPT_INJECTION]: The skill ingests data from external iOS applications which may contain malicious instructions designed to subvert the agent's testing loop.
Ingestion points: Element tree JSON files (issue-03-elements.json) and screen text parsed during the 'Plan' and 'Explore' phases in SKILL.md.
Boundary markers: No explicit delimiters or 'ignore' instructions are provided when the agent processes screen content or element trees.
Capability inventory: The agent has capabilities to execute shell commands (curl) and interact with the device via the iphone-use toolset (phone_run_steps, launch_app).
Sanitization: There is no evidence of sanitization or filtering of the content retrieved from the app's UI before it is processed by the LLM.
[EXTERNAL_DOWNLOADS]: The skill performs network operations using curl to an unspecified host defined by the $HOST variable. Since the destination is not fixed or whitelisted, it presents a risk of communicating with untrusted endpoints if the environment is misconfigured or compromised.

iphone-use-qa