The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The installation instructions for macOS, Linux, and Windows promote high-risk command patterns that download and execute scripts directly from a remote GitHub repository. Evidence (macOS/Linux): bash -c "$(curl -fsSL https://raw.githubusercontent.com/trycua/cua/main/libs/cua-driver/scripts/install.sh)". Evidence (Windows): irm https://raw.githubusercontent.com/trycua/cua/main/libs/cua-driver/scripts/install.ps1 | iex.
[COMMAND_EXECUTION]: The skill implements persistence and deep system integration via command-line tools. Persistence: The cua-driver autostart enable command registers a Windows Scheduled Task (cua-driver-serve) to ensure the driver runs at every interactive logon. Dynamic Code Execution: The page tool allows for arbitrary JavaScript execution in browser contexts via the execute_javascript action, using techniques like bookmarklet invocation or Chrome DevTools Protocol (CDP). The skill also modifies browser security settings, such as enabling JavaScript from Apple Events via automated modification of local Preferences files.
[EXTERNAL_DOWNLOADS]: The skill relies on fetching core components and updates from external sources. The cua-driver skills update command fetches code directly from GitHub release tags. The installer scripts fetch the cua-driver binary and related .app bundles from remote servers.
[PROMPT_INJECTION]: The skill possesses a significant Indirect Prompt Injection surface. Ingestion points: The get_window_state tool reads the entire accessibility tree (tree_markdown) of a target application, which can contain untrusted text or metadata provided by that application. Capability inventory: Extensive capabilities including process spawning (launch_app), keystroke injection (type_text, hotkey), and browser manipulation (execute_javascript). Boundary markers: While the skill encourages re-snapshotting to verify actions, it lacks mechanisms to sanitize or ignore malicious instructions embedded within the processed accessibility data.
[DATA_EXFILTRATION]: The core functionality of the skill involves capturing high-fidelity screenshots and complete application accessibility trees. While intended for automation, this provides the primitive necessary for large-scale data harvesting from any visible or backgrounded application, including potentially sensitive information displayed in native or web-rendered interfaces.

cua-driver-rs