The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill describes an agent platform that ingests untrusted data from multiple sources, creating a vulnerability surface where malicious external content could influence agent behavior.\n
Ingestion points: The agent ingests data through the browse tool, web_search tool, and messaging bridges for Telegram, Feishu, and QQ as documented in SKILL.md.\n
Boundary markers: There is no evidence in the documentation of explicit delimiters or instructions provided to the agent to ignore or isolate commands embedded in external data.\n
Capability inventory: The agent possesses extensive capabilities including terminal command execution (run_command), file system modifications (write_file), and JavaScript execution (execute_js).\n
Sanitization: The platform includes a PathGuard sandbox and OS-level isolation (Seatbelt/Bubblewrap) to mitigate risks, though these do not prevent the injection of malicious instructions into the model context.\n- [EXTERNAL_DOWNLOADS]: The documentation instructs users to download and execute software from an external GitHub repository (github.com/liliMozi/openhanako) that is not identified as a trusted source. \n
Security Bypass: The troubleshooting and installation sections explicitly guide users on how to bypass macOS Gatekeeper (using xattr -dr com.apple.quarantine) and Windows SmartScreen security warnings to run unsigned executables.\n- [COMMAND_EXECUTION]: The platform architecture and built-in tools support direct execution of shell commands and filesystem operations.\n
Tools: The run_command, read_file, and write_file tools grant the agent direct access to the host operating system's environment, albeit within a documented sandbox.\n- [DYNAMIC_EXECUTION]: The skill documents the platform's ability to execute arbitrary code at runtime.\n
JS Execution: The execute_js tool allows the agent to run JavaScript code dynamically.\n
Remote Skill Installation: The skillManager.installFromGitHub function allows for the dynamic installation and execution of third-party code packages, which is a significant dynamic execution vector.

openhanako-personal-ai-agent