The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill enables an attack surface where a malicious application could provide instructions to the agent through its UI.
Ingestion points: The agent reads application state, accessibility identifiers, and screen content using the describe tool and accessibility trees (AppKit, SwiftUI, React Native) as specified in SKILL.md.
Boundary markers: No explicit delimiters or instructions are provided to help the agent distinguish between app data and the instructions provided in the skill.
Capability inventory: The agent can execute build commands (xcodebuild), launch local applications via absolute paths (boot-device), and interact with the system via open-url (handling file:, http:, and https: schemes).
Sanitization: No sanitization or validation of the content retrieved from the app UI is mentioned before the agent acts on it.
[COMMAND_EXECUTION]: The skill requires the agent to perform sensitive system-level operations to manage the application lifecycle.
Evidence: Instructions in SKILL.md to execute xcodebuild for compiling applications and retrieving build settings.
Evidence: Use of boot-device to launch application bundles from arbitrary absolute paths on the disk.
Evidence: Use of open-url to pass potentially sensitive file: URLs or external http/s links to the target application.

argent-macos-app-interact