The Agent Skills Directory

[PERSISTENCE]: The skill sets up automated execution at system startup or login.
Creation of a macOS LaunchAgent at ~/Library/LaunchAgents/com.codex.dreamskin.plist.
Registration of a Windows Scheduled Task using Register-ScheduledTask with Highest run level.
[PRIVILEGE_ESCALATION]: The skill requests or performs operations that bypass system security controls.
Instructions to modify the system-wide /etc/hosts file using sudo to block specific domains.
Instructions to remove the macOS quarantine extended attribute (xattr -d com.apple.quarantine) from downloaded scripts.
Commands to set or bypass PowerShell execution policies (Set-ExecutionPolicy RemoteSigned, -ExecutionPolicy Bypass).
[DYNAMIC_EXECUTION]: The skill uses runtime process injection to modify application behavior.
Use of the Chrome DevTools Protocol (CDP) to interact with the application's underlying engine.
Injection of arbitrary JavaScript code into the running process via the Runtime.evaluate method.
[EXTERNAL_DOWNLOADS]: The skill requires downloading content from a third-party source.
Use of git clone to fetch scripts and binaries from an external GitHub repository (github.com/Fei-Away/Codex-Dream-Skin.git).
[COMMAND_EXECUTION]: The skill executes various scripts that are not bundled with the initial skill package.
Execution of shell scripts (.sh), macOS command files (.command), and PowerShell scripts (.ps1) after modification of their execution permissions.
[INDIRECT_PROMPT_INJECTION]: The skill processes external configuration files that influence its execution flow, creating a vulnerability surface.
Ingestion points: Reads config.json and custom.css from local application data directories.
Boundary markers: None identified; instructions in these files are processed directly for injection.
Capability inventory: File system writes, shell execution, network requests via curl, and JavaScript injection via CDP.
Sanitization: No validation or sanitization of the content of the CSS or configuration files is performed before injection.
[REMOTE_CODE_EXECUTION]: The skill downloads and executes scripts from a remote repository.
Pattern: https://github.com/Fei-Away/Codex-Dream-Skin.git is cloned and then its contents (installers and injection scripts) are executed.

codex-dream-skin-theme-injector