The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts/hypr-drive script executes shell commands and interacts with the Hyprland Lua environment using parameters provided at runtime. Commands such as focus-workspace and cursor interpolate these parameters directly into command strings without adequate sanitization, creating a surface for command injection within the compositor environment.- [PRIVILEGE_ESCALATION]: The scripts/install.sh setup script requires the execution of sudo commands to add the current user to the input group and to change the ownership and permissions of /dev/uinput. While these steps are required for the skill to function, they grant the agent significant low-level control over system input devices.- [PERSISTENCE]: The installation process configures and enables a systemd user service (ydotool.service) to ensure the background input daemon is automatically started and remains active across user sessions.- [DYNAMIC_EXECUTION]: The skill uses hyprctl repl to dynamically execute Lua code within the running Hyprland compositor. This mechanism is used to perform complex desktop operations like precise cursor movement and window focusing based on real-time state.- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from the local environment, creating a vulnerability surface. \n
Ingestion points: The hypr-drive script (e.g., in cmd_windows and focus_client) ingests window titles, class names, and workspace metadata which can be controlled by external applications or web content. \n
Boundary markers: The skill lacks explicit delimiters or instructions to ignore embedded commands within the ingested window metadata. \n
Capability inventory: The skill across hypr-drive and install.sh possesses extensive capabilities, including system configuration changes, shell execution, virtual input injection, and screen capture. \n
Sanitization: Input sanitization is inconsistent; while the lua_quote function attempts to escape strings for some Lua REPL calls, other commands directly interpolate user-supplied arguments into execution strings.

drive-hyprland