The Agent Skills Directory

[COMMAND_EXECUTION]: The skill defines a run() logic that provides a way to execute arbitrary shell commands on both the local host (via bash -c) and remote machines (via ssh). This grants the agent broad administrative capabilities over the connected environments.
[REMOTE_CODE_EXECUTION]: The recipe system documented in references/recipes.md explicitly allows for the execution of arbitrary bash scripts on the host machine through the shell command. The skill's workflow involves the agent searching for and automatically running these recipes, which presents a high risk if the recipe directory is populated with untrusted content.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection via its recipe lookup mechanism. The agent is instructed to glob and execute JSON and Markdown files from the recipes/ directory. Malicious instructions placed in these files could trick the agent into performing unintended actions.
[DATA_EXFILTRATION]: The skill's allowed-tools list is extremely broad, pre-approving high-privilege tools such as ssh, scp, curl, and osascript. Combined with the skill's instructions to take screenshots and read configuration files, this provides significant opportunities for credential and data exfiltration.
[COMMAND_EXECUTION]: The skill programmatically modifies the host's system configuration by using PlistBuddy to edit the config.plist of virtual machines. This level of system interaction allows the agent to change VM hardware settings and boot arguments without manual user oversight for the specific modifications.

windows