The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted visual and structural data from the macOS desktop, including web content and application windows, which creates a surface for malicious embedded instructions.
Ingestion points: The computer_use(action="capture", ...) tool described in SKILL.md ingests screenshots and Accessibility (AX) tree data from any running application.
Boundary markers: The instructions in SKILL.md include a safety section explicitly telling the agent to treat the user's original prompt as the only source of truth and to ignore instructions found within screenshots or web content.
Capability inventory: The skill allows the agent to perform a wide range of GUI actions, including click, drag, scroll, type, and key (keyboard shortcuts) as documented in the Actions section of SKILL.md.
Sanitization: The skill relies on model-side adherence to safety instructions and tool-level pattern blocking (blocking strings like sudo rm -rf) rather than programmatic sanitization of the ingested GUI data.
[COMMAND_EXECUTION]: The skill grants the agent the ability to simulate keyboard input and type text, which can be used to execute arbitrary commands if the agent is directed to interact with a terminal or system prompt.
Evidence: The type and key actions defined in SKILL.md provide a mechanism for delivering character and shortcut input to the operating system.

macos-computer-use