The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill enables an agent to interact with and observe a graphical desktop environment, creating a high-risk surface for indirect prompt injection attacks.
Ingestion points: The scripts/cu.py script captures desktop screenshots using scrot or gnome-screenshot. These screenshots are passed back to the agent as files or base64 strings.
Boundary markers: There are no instructions or delimiters provided to help the agent distinguish between legitimate application content and potentially malicious instructions embedded in the GUI (e.g., text in a web browser or document).
Capability inventory: The skill provides significant control over the environment via xdotool in scripts/cu.py, including typing text, sending key chords (like ctrl+alt+t to open a terminal), and clicking.
Sanitization: There is no filtering or sanitization of the visual data processed by the agent.
[COMMAND_EXECUTION]: The skill relies on executing system-level utilities to perform its functions.
Evidence: The scripts/cu.py script uses subprocess.run to call xdotool, scrot, xdpyinfo, and ImageMagick's convert. While the script correctly uses argument lists to prevent shell injection, it grants the agent the ability to execute these powerful tools to control the host's graphical session.

computer-use-cli