The Agent Skills Directory

[COMMAND_EXECUTION]: The system.run command allows the agent to execute arbitrary system binaries and shell commands via cmd.exe or powershell.exe on the local machine.
[PRIVILEGE_ESCALATION]: The system.execApprovals.set tool allows the agent to modify the local execution approval policy (exec-approvals.json). This can be used to add commands to an allowlist, effectively bypassing future user approval prompts for potentially dangerous operations.
[DATA_EXFILTRATION]: The skill exposes numerous tools for accessing sensitive local data, which an agent could then exfiltrate. These include:
screen.snapshot and screen.record for desktop capture.
camera.snap and camera.clip for webcam access.
stt.listen and stt.transcribe for microphone recording.
app.chat.snapshot and app.chat.queue.list, which are marked as "READ-ALL" tools for retrieving private chat history and message queues.
app.config.get and app.settings.get for reading application and system configurations.
[CREDENTIALS_UNSAFE]: The CLI supports a --mcp-token flag and the app.connection.connectSharedToken tool for handling bearer tokens. The documentation explicitly warns that tokens passed as CLI arguments are visible to other processes via the OS process listing, creating a risk of credential exposure.
[INDIRECT_PROMPT_INJECTION]: The skill describes an extensive attack surface where untrusted data could influence agent behavior through interpolation into high-privilege tools.
Ingestion points: canvas.a2ui.push (rendering JSONL), canvas.eval (executing JavaScript), and ollama.chat (processing prompts).
Boundary markers: None identified; commands accept raw JSON or string objects.
Capability inventory: The skill provides full system command execution (system.run), file system interaction, and network proxying (browser.proxy).
Sanitization: No sanitization or validation logic is described for the content passed to these execution engines.
[EXTERNAL_DOWNLOADS]: Invoking stt.* tools triggers the automatic download of machine learning models (Whisper.net) from the internet on first use.
[DYNAMIC_EXECUTION]: The canvas.eval tool allows for the dynamic execution of JavaScript strings within a WebView2 environment, and canvas.a2ui.push dynamically renders UI surfaces from JSONL payloads.

winnode