The Agent Skills Directory

[COMMAND_EXECUTION]: Several scripts utilize the Python subprocess module to execute system commands and external tools.
oi_screenshot.py and oi_click.py execute screencapture on macOS and scrot or import on Linux to capture screen data.
oi_type.py executes osascript to run AppleScript commands for keyboard interaction on macOS.
oi_os_mode.py executes the interpreter CLI as a managed subprocess.
oi_computer.py acts as a dispatcher, spawning other Python scripts as subprocesses.
[REMOTE_CODE_EXECUTION]: The oi_os_mode.py script facilitates 'OS Mode,' which delegates tasks to the OpenInterpreter agent. This agent operates in an autonomous loop, generating and executing Python or Bash code to accomplish tasks. When run with the -y flag (as documented in references/os-mode.md), it executes these actions without user confirmation.
[DYNAMIC_EXECUTION]: The skill relies on OpenInterpreter, which is designed to generate and execute code at runtime to interact with the operating system and applications. This represents an inherent risk where the agent might generate and run unintended or malicious code if influenced by adversarial input.
[EXTERNAL_DOWNLOADS]: The oi_install.sh script uses the uv package manager to install the open-interpreter[os] package and its dependencies (such as pyautogui, pytesseract, Pillow, and pyperclip) from external registries. These dependencies are required for the skill's core functionality but introduce supply-chain risks.
[INDIRECT_PROMPT_INJECTION]: The skill's OCR capabilities (oi_find_text.py, oi_click.py) ingest text from the user's screen. This creates a surface for indirect prompt injection, where malicious instructions displayed in an application or on a webpage could be read by the agent and processed as valid commands.
Ingestion points: Screen content captured via screencapture and processed by pytesseract in oi_click.py and oi_find_text.py.
Boundary markers: None identified; OCR text is processed directly to find coordinates for actions.
Capability inventory: The skill possesses full keyboard/mouse control and the ability to execute shell commands and dynamic code.
Sanitization: oi_type.py includes basic sanitization for AppleScript injection in single-character keystrokes, but no broader sanitization exists for data ingested via OCR.
[DATA_EXFILTRATION]: The skill has the capability to capture screenshots and extract text via OCR. In 'OS Mode' (oi_os_mode.py), this data is sent to the Claude API (requiring an ANTHROPIC_API_KEY) for analysis. This constitutes a flow of potentially sensitive on-screen information to an external service.

open-interpreter