The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses ffmpeg and ffprobe for media processing and metadata extraction. The scripts resolve these binaries from the system PATH, user-configured paths, or bundled binaries provided by the vendor. This is standard functionality for a media processing skill.
[EXTERNAL_DOWNLOADS]: The upload-media.mjs script contains logic to unpack and use bundled FFmpeg binaries for specific platforms (macOS Apple Silicon and Windows x64). These binaries are sourced from the skill's own directory structure and are verified using SHA-256 checksums before execution.
[DATA_EXFILTRATION]: The skill transmits media files to the vendor's API (app.chatcut.io). This is the primary and stated purpose of the 'Asset Import' skill. The serve-local-media.mjs script creates a temporary local server to facilitate drag-and-drop, which is restricted to the localhost interface, uses a random token for authorization, and automatically shuts down after a short TTL to minimize the attack surface.
[PROMPT_INJECTION]: The instructions include clear guidance for the agent on how to handle user data and permissions, specifically instructing the agent to stop and inform the user if host policies deny file uploads.

asset-import