The Agent Skills Directory

[Command Execution]: The skill provides detailed instructions on using the agent-desktop CLI to interact with the Windows operating system. This includes launching applications, manipulating windows, and performing mouse and keyboard actions. These capabilities are the primary purpose of the tool and are documented with clear usage guidelines.
[Indirect Prompt Injection Surface]: The skill describes tools like list-notifications and snapshot that ingest data from external applications, which could potentially contain untrusted instructions.
Ingestion points: Data enters the agent's context through notification titles/bodies and UI element properties (names, values, text) read from the desktop.
Boundary markers: The provided documentation does not specify the use of specific boundary markers or delimiters for this data.
Capability inventory: The documented toolset includes capabilities such as launch, click, type, and clipboard-set, which could be targeted by instructions found in UI text.
Sanitization: The guide does not outline specific sanitization or filtering steps for the ingested UI data, though it does warn the user that notification output is unredacted and sensitive.
[Privilege and Integrity Considerations]: The documentation provides an educational overview of Windows Integrity Levels and User Interface Privilege Isolation (UIPI). It correctly explains that a Medium-integrity process cannot send input to a High-integrity process and suggests running the tool at the appropriate elevation level for the target application, which is standard practice for Windows automation.
[Security Warning for Communication Pipes]: The guide includes a responsible disclosure regarding the cursor overlay's control pipe, noting that while it is restricted to the same user and session, it lacks a complex security descriptor. It advises users not to trust the overlay in multi-user environments where others can run processes as the same account.

agent-desktop-windows