The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The setup process documented in references/setup.md instructs the agent to download a compiled binary (figcraft-cli) from a GitHub repository (storytold/figcraft) and execute it. While the script includes SHA-256 checksum verification, it executes binary code from a source that is not on the established trusted organizations list.
[EXTERNAL_DOWNLOADS]: The skill fetches resources from external URLs during its installation phase:
Downloads the latest release tag and binary assets from https://github.com/storytold/figcraft/releases/latest.
Fetches SHA256SUMS.txt for integrity verification.
[COMMAND_EXECUTION]: The skill makes extensive use of local shell commands and scripts to manage the environment:
SKILL.md and references/setup.md use bash, curl, unzip, and shasum to install the toolset.
scripts/figcraft-live-mcp uses nc (netcat) to probe local ports and open to launch the desktop application.
scripts/figcraft-project-mcp uses jq to modify project configuration files and git to manage file exclusions.
[PERSISTENCE]: The scripts/figcraft-project-mcp script registers the figcraft MCP server in project-local configuration files (.mcp.json for Claude Code or .omp/mcp.json for omp). This ensures that the figcraft-live-mcp wrapper is executed in future sessions within the project scope, serving as a persistence mechanism for the skill's capabilities.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a vulnerability surface for indirect prompt injection as it ingests and processes untrusted design data and images.
Ingestion points: Reads .figcraft archives, .svg files, and various image formats (.png, .jpg, .webp) provided by the user or found in the project directory.
Boundary markers: The skill does not define specific delimiters or instructions to ignore potential commands embedded within the design metadata or file content.
Capability inventory: The skill has broad capabilities, including executing commands via the figcraft-cli, writing files during export, and controlling the desktop application UI.
Sanitization: There is no evidence of sanitization or filtering applied to content extracted from design files before it is processed by the agent's internal logic.
[SAFE]: The reverse shell pattern flagged in references/control.md (exec 3<>/dev/tcp/127.0.0.1/$port) is a false positive. In context, this is used for legitimate local inter-process communication (IPC) with the FigCraft application's control server, which is restricted to the loopback interface.

figcraft-live