The Agent Skills Directory

[COMMAND_EXECUTION]: The AnthropicComputerUse class implements a _handle_bash method that uses subprocess.run(command, shell=True). This allows the AI agent to execute arbitrary shell commands. While a basic blacklist of 'dangerous patterns' is included (e.g., rm -rf), this is easily bypassed using shell aliases, different flags, or command concatenation.
[COMMAND_EXECUTION]: The SandboxedAgent class uses subprocess.run(cmd, shell=True) where the command is constructed using string formatting. If the SandboxConfig parameters were to be influenced by untrusted external data, this could lead to command injection on the host system.
[INDIRECT_PROMPT_INJECTION]: The skill's primary function is to capture screenshots and provide them to a vision-language model for reasoning. This creates a significant surface for indirect prompt injection, where malicious instructions embedded in a web page or application UI can hijack the agent's behavior. The skill itself acknowledges this risk in the 'Sharp Edges' section.
[DATA_EXFILTRATION]: The implementation includes tools for reading and editing files (str_replace_editor). An agent compromised via indirect prompt injection could use these tools to read sensitive local files and then exfiltrate them by typing the data into a web form, sending it via the bash tool, or displaying it on screen to be captured in logs.
[DYNAMIC_EXECUTION]: The ComputerUseAgent loop dynamically parses JSON actions from the LLM's response using json.loads and regex. These actions directly map to executable system operations like click, type, and key, effectively executing model-generated logic on the system level.

computer-use-agents