The Agent Skills Directory

[PROMPT_INJECTION]: The skill documentation explicitly states that it is designed to bypass platform safety filters in Claude Code that restrict desktop control tools. This intentional circumvention of security controls allows the agent to perform mouse control and keyboard input actions that the platform provider has deemed risky.
[DYNAMIC_EXECUTION]: The initialization script (scripts/init.sh) dynamically generates a shell script (/tmp/_cu_snap.sh) and compiles a Swift utility (/tmp/_cu_scroll) at runtime. Dynamic code generation and compilation increase the attack surface and complexity of verifying the skill's runtime behavior.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from the GUI of third-party applications (e.g., chat messages in WeChat or Feishu) without boundary markers or sanitization, creating a risk that malicious embedded content could be interpreted as agent instructions. \n
Ingestion points: GUI content and screenshots of third-party applications. \n
Boundary markers: None identified in instructions or scripts. \n
Capability inventory: Mouse and keyboard control via cliclick, UI automation via osascript, and screen capturing via screencapture. \n
Sanitization: No sanitization or validation of ingested GUI content is performed.
[COMMAND_EXECUTION]: The skill relies on powerful system tools (osascript, screencapture, cliclick) to simulate user input and capture screen content. These capabilities provide a direct path for executing arbitrary actions on the host system if the agent is influenced by malicious input.

computer-use