The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill downloads and installs the agent-desktop-pp-cli bridge from the trusted vendor's repository using npx or go install. The bridge then downloads the core automation binary from the author's GitHub repository or NPM.
Evidence: npx -y @mvanhorn/printing-press-library install agent-desktop --cli-only and go install github.com/mvanhorn/printing-press-library/... and agent-desktop-pp-cli install --version latest.
[COMMAND_EXECUTION]: The skill frequently executes shell commands to install dependencies, manage OS-level permissions, and perform UI interactions like clicking, typing, and scrolling.
Evidence: Multiple shell blocks including agent-desktop snapshot, agent-desktop type, and agent-desktop permissions --request.
[DATA_EXFILTRATION]: The tool accesses highly sensitive system information, including clipboard contents, active desktop notifications, and real-time screen snapshots/screenshots, which are required for its primary automation function.
Evidence: Commands such as clipboard-get, list-notifications, and screenshot.
[PRIVILEGE_ESCALATION]: The skill requests elevated OS permissions on macOS, specifically Accessibility, Screen Recording, and Automation permissions, which allow programmatic control of the operating system.
Evidence: agent-desktop permissions --request.
[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests untrusted data from the accessibility tree and screen content of external applications.
Ingestion points: agent-desktop snapshot, agent-desktop list-notifications, agent-desktop clipboard-get.
Boundary markers: None observed in the instructions to prevent the agent from obeying instructions found within the UI data.
Capability inventory: agent-desktop click, agent-desktop type, agent-desktop press, agent-desktop launch, agent-desktop close-app.
Sanitization: No sanitization or filtering of external UI content is described.

agent-desktop