The Agent Skills Directory

Indirect Prompt Injection: The skill enables the agent to read UI elements (such as labels, names, and values) from running applications. If a third-party application contains malicious instructions within its UI metadata, it could lead to indirect prompt injection.
Ingestion points: UI data is ingested through commands like winapp ui inspect, search, and get-value as described in SKILL.md.
Boundary markers: No explicit boundary markers or instructions to ignore embedded commands are provided for the ingested UI content.
Capability inventory: The skill possesses extensive interaction capabilities, including invoke, click, send-keys, and set-value, which could be influenced by malicious UI content.
Sanitization: There is no evidence of sanitization or validation of the UI content before it is processed by the agent.
Desktop Interaction and Input Injection: The skill utilizes commands to drive application UI. While these are core features, they allow the agent to perform actions on the local system, including the use of the --allow-system-keys flag which permits the generation of global system hotkeys.
Screen Capture Capabilities: The screenshot and record commands allow for capturing the visual state of applications or the desktop. This is a functional requirement for the skill's purpose but involves the handling of potentially sensitive visual information.

winapp-ui-automation