The Agent Skills Directory

[PERSISTENCE]: The skill provides explicit instructions for establishing persistent agent behavior by writing new Lua modules to ~/.hammerspoon/ and modifying the init.lua entry point to load these modules automatically.
[PRIVILEGE_ESCALATION]: The skill documentation guides the user to grant Accessibility permissions in macOS System Settings. These permissions allow the agent to bypass standard application sandboxing, interact with UI elements, capture keystrokes, and monitor application focus across the entire operating system.
[DATA_EXFILTRATION]: The skill includes functionality to read and expose sensitive user data to the agent context, including the system clipboard contents (hs.pasteboard.getContents()), current Wi-Fi network names (hs.wifi.currentNetwork()), and the URLs and titles of all open browser tabs via AppleScript.
[COMMAND_EXECUTION]: The core mechanism of the skill involves executing arbitrary Lua code through the hs command-line interface (hs -c), which provides a gateway for running system-level commands and AppleScript within the host environment.
[DYNAMIC_EXECUTION]: The skill relies on dynamic execution by passing generated Lua strings to a runtime interpreter. It also supports dynamic loading of modules through the require keyword in the persistent configuration files it instructs the agent to create.
[INDIRECT_PROMPT_INJECTION]: The skill presents an attack surface for indirect prompt injection by ingesting data from untrusted sources (like browser tab titles or clipboard content) and potentially processing that data without sanitization.
Ingestion points: System clipboard content, browser tab URLs, browser tab titles, and application window titles are all read into the agent context.
Boundary markers: There are no instructions or patterns provided to delimit untrusted data or warn the agent to ignore instructions embedded within retrieved content.
Capability inventory: The agent can execute shell commands, run AppleScript, write files to the home directory, and perform system-level actions like locking the screen or killing processes.
Sanitization: No sanitization or validation logic is present to escape or filter data retrieved from the clipboard or web browser before it is interpolated into shell commands or interpreted as logic.

hammerspoon