The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides numerous shell commands for system auditing, binary analysis (using otool, codesign, nm), and execution of external payloads via system() calls in compiled C code or child_process.execSync() in Node.js.\n- [DYNAMIC_EXECUTION]: Instructions generate C source code at runtime and compile it using gcc -dynamiclib to create dynamic libraries for process injection. It also details methods for extracting and repacking Electron .asar files to inject code into an application's startup flow.\n- [PRIVILEGE_ESCALATION]: Documents multiple techniques to bypass process isolation and inherit target process permissions and TCC entitlements, including DYLD environment variable injection, XPC PID reuse race conditions, and Mach task port manipulation (task_for_pid).\n- [PERSISTENCE]: Details dylib hijacking methods (such as weak dylib and @rpath hijacking) that allow code to be executed automatically every time the target application is launched.\n- [REMOTE_CODE_EXECUTION]: Includes a Python script that uses the Chrome DevTools Protocol to execute arbitrary JavaScript in the main process of Electron applications via local network communication on port 9229.\n- [EXTERNAL_DOWNLOADS]: Suggests installing the @electron/asar utility from the NPM registry to modify application resources.\n- [INDIRECT_PROMPT_INJECTION]: The skill ingests user-provided binary paths and process IDs which are then used as arguments for sensitive operations including memory manipulation and shell execution. There is no evidence of sanitization or boundary markers to prevent the injection of malicious arguments into these high-privilege capabilities. Evidence Chain: 1. Ingestion points: User-provided binary paths and PIDs. 2. Boundary markers: Absent. 3. Capability inventory: Compiled code execution, memory manipulation, shell commands. 4. Sanitization: Absent.

macos-process-injection