The Agent Skills Directory

[COMMAND_EXECUTION]: Multiple Python scripts (analyze_caches.py, analyze_code_sign_clones.py, analyze_dev_env.py, analyze_large_files.py, cleanup_report.py, find_app_remnants.py, safe_delete.py) utilize subprocess.run to execute system utilities including du, df, find, lsof, getconf, and docker to perform storage analysis.
[EXTERNAL_DOWNLOADS]: The references/mole_integration.md file encourages the installation of a third-party CLI tool called 'Mole' from a non-whitelisted GitHub tap (tw93/tap/mole) using Homebrew.
[PRIVILEGE_ESCALATION]: The skill instructions and the references/apple_content_caching.md file document and propose the execution of commands using sudo, such as /usr/bin/sudo /usr/bin/AssetCacheManagerUtil deactivate, to manage system-level services.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a vulnerability surface for indirect prompt injection as it ingests untrusted data from the file system, including application names, file paths, and bundle identifiers, which are then processed by the agent to categorize storage usage.
Ingestion points: File names and directory metadata are read in scripts/analyze_large_files.py and scripts/find_app_remnants.py.
Boundary markers: The instructions emphasize separating observation from mutation and requiring exact confirmation phrases, which acts as a partial mitigation.
Capability inventory: The skill has file-deletion capabilities (via safe_delete.py and AppleScript Trash commands) and network command execution capability (via proposed shell commands).
Sanitization: There is no explicit sanitization of file names or bundle IDs before they are presented to the agent context.
[DATA_EXFILTRATION]: While the skill primarily focuses on local analysis, it inventories sensitive locations such as ~/Library/Application Support, ~/Library/Logs, and directory structures which could be exfiltrated if the agent environment is compromised, although no active exfiltration code was detected.

macos-cleaner