The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The agent relies on visual and structural analysis of the Android device's screen to determine its next steps. Malicious content displayed on the screen (e.g., inside a web browser, a chat application, or a notification) could contain instructions that influence the agent's behavior.
Ingestion points: SKILL.md specifies reading .tmp/screen.png using the Read tool and parsing .tmp/ui.xml generated by uiautomator dump.
Boundary markers: None. The agent treats all text found on the screen as part of the environment to be processed.
Capability inventory: The agent has broad control over the device via adb, including the ability to tap coordinates, type text, launch applications, and open arbitrary URLs.
Sanitization: No sanitization or filtering of the content extracted from the screen or UI dump is mentioned.
[DATA_EXPOSURE]: The skill accesses highly sensitive data sources on the connected Android device.
System Logs: The use of adb logcat -d -t 50 in step 5 allows the agent to read system logs, which frequently contain PII, tokens, and other sensitive diagnostic data.
Screen Content: The screencap and uiautomator dump commands capture everything currently visible on the device, potentially including private messages, passwords (if visible), or banking information.
[COMMAND_EXECUTION]: The skill makes extensive use of shell command execution to interface with the adb binary. While necessary for the skill's primary function, it grants the agent the ability to perform high-impact actions on the target device, such as installing packages or opening arbitrary URLs via Android intents.

adb