The Agent Skills Directory

[METADATA_POISONING]: The skill incorrectly labels links to sosumi.ai as "Official Apple Documentation" in the References section of SKILL.md. Official Apple API references are hosted on developer.apple.com. Misrepresenting third-party sources as official is deceptive and can lead developers to trust unverified guidance.
[INDIRECT_PROMPT_INJECTION]: The skill describes patterns for processing and previewing external local files, creating a vulnerability surface where malicious file content could exploit system-level parsing frameworks.
Ingestion points: The fileURL and urls parameters in SKILL.md (DocumentRowView, DocumentPreviewCoordinator) and references/quicklook-patterns.md (QuickLookSheet, ProgressiveThumbnailLoader) accept arbitrary local file paths.
Boundary markers: Absent. The skill does not include instructions to use delimiters or security warnings when handling content from untrusted local files.
Capability inventory: The skill utilizes QLPreviewController and QLThumbnailGenerator (referenced in SKILL.md and references/quicklook-patterns.md), which involve complex system-level parsing and rendering of document, image, and 3D media content.
Sanitization: The QuickLookValidator class in references/quicklook-patterns.md provides basic Uniform Type Identifier (UTType) validation to ensure files match supported formats, but no sanitization of the actual file data is performed.

quicklook