The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/macos_click.py uses subprocess.run to execute AppleScript commands via osascript. The skill attempts to mitigate injection risks through a _sanitize_app_name function that restricts input to alphanumeric characters, spaces, hyphens, and periods. However, the use of dynamically generated shell commands still represents a potential attack surface.
[PRIVILEGE_ESCALATION]: The skill requires the user to grant "Accessibility" permissions to the execution environment (e.g., Terminal). This is a high-privilege OS permission that allows the skill to generate hardware-level input events and control other applications, which is a powerful capability that could be misused if the agent is compromised.
[INDIRECT_PROMPT_INJECTION]: The skill interacts with the native macOS UI based on coordinates derived from screenshots or window queries, creating an indirect prompt injection surface.
Ingestion points: UI metadata and screenshots processed by the agent (referenced in SKILL.md).
Boundary markers: None identified in the provided instructions.
Capability inventory: Simulation of hardware-level mouse/keyboard events and AppleScript execution (implemented in scripts/macos_click.py).
Sanitization: The script includes a whitelist-based sanitization function (_sanitize_app_name) for application names, though it does not provide sanitization for the UI elements it interacts with.

macos-native-automation