The Agent Skills Directory

[DATA_EXFILTRATION]: The skill accesses the system clipboard to retrieve structured JSON data from the whiteboard. It instructs the agent to execute platform-specific commands—pbpaste (macOS), xclip (Linux), or Get-Clipboard (Windows)—which read the entire clipboard contents. This behavior creates a risk of exposing sensitive information (such as credentials or personal data) that the user might have copied previously, as the agent receives the full clipboard text rather than just the specific data intended for the skill.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to process external, untrusted content from two sources, creating an injection surface.
Ingestion points: The agent reads PNG snapshots from ~/Downloads or ~/Desktop and text data from the system clipboard. These files and the clipboard state can be influenced by other local applications or malicious files.
Boundary markers: There are no explicit instructions or delimiters used to ensure the model distinguishes between valid whiteboard content and malicious instructions hidden within the drawings or text.
Capability inventory: Across its scripts, the skill can write files to the Desktop, read local files via the multimodal vision tool, and execute shell commands to read the clipboard and open the browser.
Sanitization: The skill does not perform any validation, sanitization, or filtering of the clipboard data or visual content before passing it to the model for analysis.
[COMMAND_EXECUTION]: The skill uses shell commands to interact with the operating system, specifically for opening the whiteboard HTML file in the default browser (open, xdg-open, start) and for accessing clipboard utilities. While these support the skill's primary purpose, they involve direct execution of system tools.

napkin