The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to configure the Hosted MCP server by running claude mcp add-json targeting the vendor's API at https://api.chatcut.io/api/external-mcp/mcp.
[COMMAND_EXECUTION]: Facilitates user authentication by executing a local shell script login-chatcut.sh bundled within the skill directory, which outputs results to a temporary log file at /tmp/chatcut-login.log.
[EXTERNAL_DOWNLOADS]: The skill uses curl to fetch temporary image resources from signed URLs generated by the frame tools for visual verification and inspection purposes.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process external project data, which constitutes an attack surface for indirect prompt injection.
Ingestion points: External data enters the context through browse_assets, inspect_asset, read_project, and preview_timeline tool results which provide metadata, asset information, and transcripts.
Boundary markers: No explicit delimiters or instructions to ignore embedded commands are specified for the ingested media metadata or transcripts.
Capability inventory: The skill has access to shell execution (node, ffmpeg, ffprobe, claude mcp), file system writes (log files), and network operations via curl and MCP tools.
Sanitization: The instructions do not mandate specific sanitization or escaping of untrusted strings before they are processed by the agent.

chatcut-plugin-basics-claude