The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion of untrusted data from the macOS desktop environment, creating a vulnerability where instructions embedded in UI content could be interpreted by the agent.
Ingestion points: Uses computer_snapshot and computer_get (SKILL.md) to read the accessibility tree, text, and values from active desktop applications.
Boundary markers: No instructions or delimiters are defined to help the agent distinguish between UI labels and potentially malicious instructions contained within those applications.
Capability inventory: The skill employs computer_click, computer_type, and computer_press (SKILL.md) to interact with the host system, allowing actions to be taken based on ingested data.
Sanitization: There is no evidence of filtering or sanitization of the content retrieved from the desktop UI before processing.
[COMMAND_EXECUTION]: The skill utilizes tools that perform direct actions on the host operating system's desktop environment outside of a browser sandbox.
Evidence: Provides instructions for using computer_launch, computer_click, and computer_type to control native applications directly on the host machine.

agent-desktop