The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill requires installing software from an unverified Homebrew tap (tddworks/tap/baguette) and cloning source code from an external GitHub repository (github.com/tddworks/baguette). These sources are not affiliated with recognized trusted organizations.
[REMOTE_CODE_EXECUTION]: The instructions include cloning a third-party repository and running build commands (make), which executes unverified code on the host machine.
[COMMAND_EXECUTION]: The agent is directed to use CLI commands for system-level simulator management (baguette boot, baguette shutdown) and package installation, which could be misused if commands are not carefully validated.
[INDIRECT_PROMPT_INJECTION]: The tool processes JSON-based gesture commands from standard input and WebSockets. This creates a vulnerability where malicious data could be used to manipulate the simulator's UI.
Ingestion points: baguette input command and the /simulators/:udid/stream WebSocket endpoint.
Boundary markers: No security boundaries or instructions to ignore embedded commands are documented for the JSON input stream.
Capability inventory: Full HID event injection including multi-finger gestures and hardware button presses.
Sanitization: Input is parsed for structure but not for malicious behavioral patterns.
[DATA_EXFILTRATION]: The skill can stream the simulator's screen content over the network. Starting the server on all interfaces (0.0.0.0) could allow unauthorized observers to capture sensitive visual information from the simulator.
[PRIVILEGE_ESCALATION]: Troubleshooting steps suggest using sudo xcode-select, which grants administrative access to modify system-wide developer settings.

baguette-ios-simulator