The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides implementation logic for desktop automation using pyautogui, allowing an agent to perform clicks, type text, and press keys. It also utilizes subprocess.run for system-level actions such as screenshot capture using the scrot utility.
[INDIRECT_PROMPT_INJECTION]: The architecture described (Perception-Reasoning-Action) is inherently vulnerable to indirect prompt injection where malicious instructions embedded in the GUI could be executed by the vision-language model.
Ingestion points: The capture_screenshot method in SKILL.md captures the entire screen as a base64 image for vision model processing.
Boundary markers: No boundary markers or "ignore embedded instruction" delimiters are used to separate GUI content from agent instructions.
Capability inventory: The skill provides templates for full GUI control (pyautogui) and shell command execution (subprocess.run).
Sanitization: The execute_action and _handle_computer_action functions execute LLM-generated actions and text without prior validation or sanitization.
[SAFE]: The skill explicitly advocates for and provides templates for sandboxed environments. The included Docker and Compose configurations use security hardening techniques such as creating a non-root user, enforcing a read-only root filesystem, restricting network access via internal bridges, and applying resource limits to minimize the blast radius of potential failures.

computer-use-agents