The Agent Skills Directory

[COMMAND_EXECUTION]: Vulnerability detected in scripts/adapters/desktop.py. The _find_window_ids_macos and _list_windows_macos methods use f-strings to interpolate user-controlled variables (app_name, window_title) directly into Python code executed via python3 -c. This allows for arbitrary code execution if a malicious application name is provided.
[EXTERNAL_DOWNLOADS]: The skill automatically installs the @playwright/mcp package from the npm registry using npm install -g if the tool is not found during pre-flight checks. It also utilizes curl to transmit captured image data to third-party hosting services including 0x0.st and api.imgbb.com.
[REMOTE_CODE_EXECUTION]: The skill implements a Windows capture method that writes a dynamic PowerShell script to a temporary file and executes it with -ExecutionPolicy Bypass, which bypasses local script execution restrictions.
[COMMAND_EXECUTION]: The orchestrator script scripts/screenshot.py and its adapters invoke numerous system utilities (such as screencapture, scrot, sips, and ImageMagick) using subprocess calls with arguments derived from user-supplied strings.

screenshot