The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill creates a surface for indirect prompt injection by reading content from macOS Notes, which is a data source that can be modified by external actors (e.g., via iCloud sync or other applications).
Ingestion points: The get subcommand in draft-park.sh (documented in SKILL.md) reads the body of a note into the agent's context.
Boundary markers: The skill uses a ------ separator and a provenance footer (Parked by Claude Code) to identify the end of a draft, and provides a --body-only flag to help isolate the content, but these markers can be spoofed or bypassed by malicious content within the note.
Capability inventory: The agent has access to the Bash tool. If the agent follows instructions found within a retrieved note (e.g., being told to execute a command after reading a draft), it could perform unauthorized actions.
Sanitization: The tool includes logic to decode HTML entities and handle legacy AppleScript formatting issues, but it lacks semantic sanitization to prevent the agent from interpreting note content as executable instructions.
[COMMAND_EXECUTION]: The skill uses the Bash tool to execute osascript commands, which interact with the macOS Notes and Stickies applications. While these commands are intended for note management, AppleScript is a high-privilege automation tool that can control many aspects of the operating system.
[DYNAMIC_EXECUTION]: The skill exhibits dynamic execution patterns in two ways:
Engine resolution: The draft-park.sh shim dynamically determines the path to the TypeScript engine (scripts/draft-park.ts) at runtime and executes it using bun. This execution path relies on searching local plugin directories and marketplace mirrors.
Self-modification instructions: The SKILL.md contains instructions for the agent to "Self-Evolve" by fixing SKILL.md and the shared engine code if behavior drifts, which encourages the agent to rewrite its own source files at runtime.

draft-park