The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill dynamically installs external packages during execution.
scripts/utils.py contains logic to check for and install pyautogui and pillow using pip install via a subprocess if they are not already present.
[COMMAND_EXECUTION]: The skill executes system-level commands to manage its environment.
scripts/utils.py uses subprocess.check_call to invoke the pip package manager, which involves executing external processes with the agent's privileges.
[PROMPT_INJECTION]: The documentation contains potentially ambiguous instructions for the agent.
SKILL.md includes a table entry | "xxx" | 直接执行 xxx | (Directly execute xxx), which might encourage the agent to execute arbitrary user input without sufficient validation or context checking.
[DATA_EXFILTRATION]: The skill possesses capabilities to access highly sensitive desktop data.
scripts/screen.py can capture full-screen or regional screenshots, which may inadvertently include passwords, private communications, or other sensitive information displayed on the user's monitor.
[REMOTE_CODE_EXECUTION]: While no direct remote code execution was found, the combination of dynamic package installation and simulated keyboard input creates a significant attack surface.
scripts/keyboard.py allows typing arbitrary text, which could be used to execute commands in a terminal or run scripts if the agent is influenced by malicious external data (Indirect Prompt Injection).

pyautogui-automation