The Agent Skills Directory

[COMMAND_EXECUTION]: The skill implements multiple actions that execute arbitrary shell and PowerShell commands on the host system.
actions/shell_actions.py: The RunShellAction and ExecuteCommandAction classes use subprocess.run(command, shell=True) to execute user-supplied strings as shell commands.
actions/system_actions.py: RunCommandAction executes arbitrary commands via cmd or powershell.
actions/ui_collect_actions.py: _get_process_exe and GetUITreeAction use subprocess.run to execute PowerShell scripts for system interrogation.
actions/window_actions.py: subprocess_run_ps and various helper functions execute PowerShell for window management tasks.
[REMOTE_CODE_EXECUTION]: The CLI harness employs a pattern that executes dynamically generated Python code.
agent-harness/cli_anything/windows_control/windows_control_cli.py: The _run_action function constructs a Python script as a string, including serialized arguments, and executes it using subprocess.run([sys.executable, "-c", script]). This allows for arbitrary Python execution within the action context.
[DYNAMIC_EXECUTION]: The skill infrastructure relies on dynamic loading of code at runtime.
skills/skill_loader.py: load_from_module uses importlib and exec_module to dynamically load and execute Python files from the file system as agent skills.
actions/action_registry.py: _import_module and _import_module_from_path use __import__ to dynamically load action implementations from specified directories.
actions/web_actions.py: ExecuteJavascriptAction allows the execution of arbitrary JavaScript code within a headless Playwright browser instance.
[DATA_EXFILTRATION]: The skill provides a set of tools that, when chained, facilitate data theft.
actions/shell_actions.py: ReadFileAction and ListFilesAction allow the agent to read arbitrary files and list directory contents across the entire file system.
actions/ui_collect_actions.py: CaptureWindowScreenshotAction and CaptureDesktopScreenshotAction can capture sensitive visual information from the desktop.
actions/web_actions.py: WebCrawlerAction and NavigateToUrlAction provide the ability to transmit data to external URLs. An agent could be instructed to read a sensitive file (e.g., SSH keys or .env files) and exfiltrate it via a web request.
[INDIRECT_PROMPT_INJECTION]: The skill creates a vulnerability surface for indirect attacks by processing untrusted data.
The WebCrawlerAction and ReadFileAction ingest content from web pages and local files into the agent's context without explicit sanitization or boundary markers (e.g., delimiters). Maliciously crafted content in these sources could trigger the agent to execute dangerous actions using the skill's high-privilege capabilities.

windows-control