The Agent Skills Directory

[COMMAND_EXECUTION]: The skill constructs PowerShell commands by directly concatenating user-supplied input from the prompt into the task arguments. This interpolation pattern creates a direct path for command injection if the input contains shell metacharacters.
[PRIVILEGE_ESCALATION]: The automation scripts utilize New-ScheduledTaskPrincipal with the capability to set the -RunLevel to 'Highest'. This allows the agent to execute actions with full administrative privileges, bypassing standard user session limitations.
[REMOTE_CODE_EXECUTION]: The instructions mandate the use of the --yolo flag when executing the Codex CLI. This flag is explicitly designed to disable all built-in security sandboxes and manual approval protections, granting the executed code unrestricted access to the underlying system.
[EXTERNAL_DOWNLOADS]: The skill includes instructions to silently install AutoHotkey using winget. Downloading and installing software at runtime from external repositories introduces supply chain risks and increases the host's attack surface.
[PERSISTENCE_MECHANISMS]: The skill relies on Register-ScheduledTask to orchestrate actions in interactive sessions. While the skill outlines cleanup steps, the creation of scheduled tasks is a persistence technique that could leave backdoors if the cleanup phase fails or is interrupted.
[OBFUSCATION]: The skill recommends the use of the PowerShell -EncodedCommand parameter for script execution. While used for character handling, executing Base64-encoded blocks is a common method for concealing malicious activity from endpoint detection and response (EDR) systems.
[INDIRECT_PROMPT_INJECTION]: The skill processes external user requests that are eventually executed in a high-privilege environment without sufficient isolation.
Ingestion points: User-provided <narrow computer-use request> assigned to the $prompt variable in SKILL.md.
Boundary markers: Absent; there are no instructions to use delimiters or ignore embedded instructions within the processed data.
Capability inventory: The skill has capabilities for file system writes (-o "$resultPath"), scheduled task management, and system-level command execution.
Sanitization: Absent; the skill suggests minimal escaping of double quotes, which does not prevent all forms of shell-based injection attacks.

use-windows-vm-computer-use