The Agent Skills Directory

Indirect Prompt Injection (HIGH): The skill is designed to ingest untrusted data from external sources (websites, mobile apps, and native macOS apps) and possesses powerful execution capabilities.
Ingestion points: mcp__claude-in-chrome__read_page (Web), mcp__ios-simulator__ui_describe_all (iOS), and mcp__mac-mcp-server__get_ui_elements (macOS).
Boundary markers: Absent. There are no instructions for sub-agents to ignore or sanitize embedded commands within the UI or page content.
Capability inventory: mcp__claude-in-chrome__javascript_tool (JS execution), mcp__electron__send_command_to_electron (JS/Command execution in Electron), and native interaction tools like mcp__mac-mcp-server__type_text.
Sanitization: Absent. The workflows directly process UI elements and execute commands based on the findings.
Data Exposure (HIGH): The skill explicitly instructs agents to read sensitive local files located at ~/.claude/agents/*.md (e.g., quality-engineer.md, gui-phd-web-electron.md). These files often contain proprietary instructions, configurations, or credentials for AI agent environments.
Dynamic Execution (HIGH): The workflows utilize tools such as send_command_to_electron and javascript_tool to execute arbitrary code within the context of the application being tested. This is highly dangerous if the input to these commands is influenced by malicious content on a web page or in an app UI.
Excessive Permissions (MEDIUM): The allowed-tools list includes broad access to Bash, Write, Edit, and various system-level MCP servers, providing a large attack surface if any of the specialized agents are compromised via injection.

qa-team