The Agent Skills Directory

[COMMAND_EXECUTION]: The skill makes extensive use of local shell environments (bash on macOS, PowerShell on Windows) and interpreters (Perl for timeouts, Python for database reads) to drive the Aside CLI, manage session locks, and handle process life cycles.
[PERSISTENCE]: Provides templates and configurations for creating recurring jobs using native OS schedulers, including cron and LaunchAgents on macOS, and Task Scheduler (via schtasks) on Windows.
[INDIRECT_PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by design, as it ingests authenticated web data and grants the agent shell access. It implements the following security posture:
Ingestion points: Authenticated web content from sources like Gmail, Notion, Slack, and X is retrieved via snapshot() and specialized REPL globals.
Boundary markers: Relies on prompt-based "write fences" (e.g., "Write and edit files only under ") to instruct the agent on filesystem boundaries.
Capability inventory: The agent is granted shell access via the bash tool (resolving to PowerShell on Windows), arbitrary JavaScript execution via repl, and full filesystem access when requested.
Sanitization: Relies on the agent's ability to follow instructions and user-defined absolute paths for output rather than technical data sanitization.
[CREDENTIALS_UNSAFE]: Interacts with local credential stores (models.json, accounts.json, state.db) for browser automation and password management. The skill includes explicit warnings and instructions for users to avoid printing, committing, or improperly sharing these plaintext secrets.
[PRIVILEGE_ESCALATION]: Recommends the use of the --permission full-access flag for the CLI agent. This bypasses the Aside browser's default technical sandbox (guard mode), granting the agent the same filesystem permissions as the user running the CLI process.

aside-jun