The Agent Skills Directory

[PROMPT_INJECTION]: The skill contains self-referential instructions that command the agent to avoid using file-reading tools like 'sed' or 'cat' on its own skill files and to override internal routing heuristics when specific user-input tags ($computer-use) are present.
[PROMPT_INJECTION]: Potential for Indirect Prompt Injection due to the ingestion of untrusted data from the browser DOM and desktop accessibility trees. Evidence chain:
Ingestion points: cli-jaw browser snapshot and get_app_state(app) read external UI text.
Boundary markers: Enforcement of a structured transcript format (path=, action_class=).
Capability inventory: Full interactive control over the desktop via click, drag, type_text, and set_value tools.
Sanitization: No documentation of filtering or escaping for data ingested from the UI.
[COMMAND_EXECUTION]: Execution of the cli-jaw suite and various 'Computer Use' tool calls to perform system-level automation tasks.
[EXTERNAL_DOWNLOADS]: The skill metadata references the installation of the cliclick utility via the Homebrew package manager as an optional fallback for pointer actions.

desktop-control