The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill instructions in SKILL.md explicitly direct the user or agent to install the cua CLI tool by downloading a script from https://cua.ai/install.sh and piping it into the shell (sh). This method of execution allows for unverified remote code to run on the host system, a high-risk pattern flagged by automated scanners.
[COMMAND_EXECUTION]: The cua do shell command, documented in references/command-reference.md, allows the agent to execute arbitrary shell commands on the target machine. While intended for automation, this capability provides a broad attack surface for unauthorized system modification or data access if the agent's instructions are manipulated.
[INDIRECT_PROMPT_INJECTION]: The skill uses an AI-powered snapshot tool to interpret visual data from the screen. This creates a vulnerability where malicious text or instructions displayed on a user's screen or a web page could be ingested as instructions by the agent.
Ingestion points: Screen captures and AI-generated element summaries generated via cua do snapshot in SKILL.md.
Boundary markers: None specified in the skill's instructions or command reference to distinguish system instructions from screen content.
Capability inventory: Extensive system control including shell command execution (cua do shell), file access (cua do open), and full simulated user input (keyboard and mouse control).
Sanitization: No mechanism is described to sanitize or validate the content extracted from the UI before it influences the agent's logic.

gui-automation