The Agent Skills Directory

[PERSISTENCE]: The skill's install command creates and registers a macOS LaunchAgent (located at ~/Library/LaunchAgents/dev.pstack.pulse.plist). This ensures that the monitoring daemon starts automatically whenever the user logs in and continues to run in the background across system restarts.
[DYNAMIC_EXECUTION]: The monitoring daemon periodically (every 2 seconds) attempts to execute a Node.js script found at a computed path relative to the current working directory of an active agent session. Specifically, in scripts/lib/io.mjs, the railOf function executes node .agents/pstack/plan-page.mjs if it exists in the repository root. This execution happens automatically in the background, allowing a malicious repository to achieve code execution on the user's machine if the agent is used to open or edit that repository.
[DATA_EXFILTRATION]: The skill collects and transmits sensitive session data—including session titles, current working directories, and terminal transcripts—to the external API activitysmith.com. The skill also recommends using tailscale funnel to expose a local web server (serving session information and transcripts) to the public internet.
[COMMAND_EXECUTION]: The skill extensively uses spawnSync and custom wrappers to execute shell commands. This includes managing system services via launchctl, interacting with the macOS Keychain via security, querying local databases via sqlite3, and performing various git operations. These operations are performed by both the installation script and the background daemon.
[INDIRECT_PROMPT_INJECTION]: The daemon is designed to ingest and process untrusted data from external sources, creating an attack surface for indirect prompt injection.
Ingestion points: The readRollout function in scripts/lib/io.mjs reads content from session transcript files, and readFindings reads from .decisions.tsv files within project directories.
Boundary markers: None. The skill parses these files directly to determine session state and findings.
Capability inventory: The daemon has the ability to execute arbitrary shell commands and Node.js scripts as identified in the Command Execution and Dynamic Execution findings.
Sanitization: There is minimal sanitization; content from transcripts is parsed as JSON, and fields are clipped for display, but the presence of specific markers in the transcript triggers logic changes in the daemon.

pstack-pulse