The Agent Skills Directory

[PROMPT_INJECTION]: The skill documents an attack surface for indirect prompt injection by facilitating the loading and processing of untrusted web content within a desktop shell.
Ingestion points: Untrusted data enters the agent-managed context via BrowserWindow and BrowserView through the loadURL and loadHTML methods documented in SKILL.md and reference/api-patterns.md.
Boundary markers: The documentation includes specific security patterns such as sandbox: true and navigationRules (e.g., using glob patterns like ^* to block all navigation) to isolate untrusted content, though their application is left to the developer.
Capability inventory: The framework exposes high-privilege capabilities across all scripts, including file system path resolution (Utils.paths), clipboard read/write access (Utils.clipboardReadText), system file dialogs (Utils.openFileDialog), and shell execution (Utils.openPath, Utils.openExternal).
Sanitization: The provided patterns do not demonstrate explicit sanitization or validation of data received via the RPC bridge (BrowserView.defineRPC) before it is used in the Bun process.
[DATA_EXPOSURE]: Documents APIs that provide access to sensitive OS paths (e.g., Utils.paths.home, Utils.paths.appData), user cookies via Session.cookies.get, and clipboard contents.
[COMMAND_EXECUTION]: Provides instructions for executing system-level commands through Utils.openPath and Utils.openExternal, which can be used to launch local files or external resources.

electrobun-app-shell