The Agent Skills Directory

GUI Data Access Capabilities: The skill documents the use of commands for capturing screenshots (screenshot) and accessing the system clipboard (clipboard-get). These are core features of the desktop automation tool but facilitate the handling of potentially sensitive user data.
Indirect Prompt Injection Surface: The agent is instructed to observe and process text from external GUI sources, including window content, notifications (list-notifications), and terminal output. This external data could contain instructions intended to influence the agent's behavior.
Ingestion points: GUI element text via snapshot and get, system notifications via list-notifications, and clipboard content via clipboard-get (SKILL.md, references/capture-and-clipboard.md, references/shell-tray-and-notifications.md).
Boundary markers: The documentation highlights behavior but does not define specific delimiters for untrusted GUI text within these reference files.
Capability inventory: The skill enables full GUI control, including click, type, press, launch, close-app, and window management (references/windows-and-lifecycle.md, references/display-servers-and-input.md).
Sanitization: No specific sanitization or filtering of the ingested GUI text is described in this platform guide.
Sensitive Field Visibility: The documentation notes that certain GTK4 input fields may expose their text content to observation commands if they are not explicitly assigned a password role by the application developer (SKILL.md, references/troubleshooting.md).
Security Hardening Recommendations: The skill includes best practice advice, such as ensuring the agent's state root directory is private (chmod 700) to prevent unauthorized access by other users on the system (references/bus-and-permissions.md).

agent-desktop-linux