The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses local Python scripts to automate the building and signing process. These scripts interact with system tools like ssh, scp, and curl using the subprocess module. Command arguments are passed as lists to prevent shell injection, and dynamic values are quoted using shlex.quote or filtered against allowlists (e.g., in sign_shortcut.py and appintent_catalog.py).
[DATA_EXFILTRATION]: An optional signing backend allows users to upload shortcut drafts to the RoutineHub signing service. This behavior is clearly documented as a privacy trade-off, is disabled by default, and requires explicit user agreement via a mandatory configuration flag (--i-understand-upload) as specified in SKILL.md.
[EXTERNAL_DOWNLOADS]: The skill fetches data from well-known public APIs and community-standard services (e.g., RoutineHub, httpbin.org, agify.io) during shortcut generation, validation, and self-testing. These interactions are transparent and serve legitimate functional purposes.
[CREDENTIALS_UNSAFE]: The system is designed to handle credentials securely. SSH passwords for the Mac signing backend are never stored on disk; instead, they are referenced by environment variable names. The documentation in README.md and SKILL.md provides clear guidance on using SSH keys as a safer alternative.
[INDIRECT_PROMPT_INJECTION]: The skill includes a surface for processing user-supplied natural language to generate XML. It mitigates injection risks by:
Ingestion points: User prompts in SKILL.md and remixed XML files.
Boundary markers: Explicitly placing user prompts in designated comment blocks in the generated XML (BEST_PRACTICES.md) to distinguish user input from generated instructions.
Capability inventory: Restricting agent capabilities to specific scripts for file, network, and command operations.
Sanitization: Using a robust validator (validate_shortcut.py) that enforces strict action identifier and parameter schema checks based on official Apple ToolKit snapshots, ensuring generated shortcuts contain only valid, recognized actions.

shortcuts-builder