The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill automates the download, verification, and execution of a binary from a third-party GitHub repository (github.com/storytold/figcraft) which is not recognized as a trusted source.
Evidence: SKILL.md contains a bash script that fetches the latest release tag, downloads the binary asset and a SHA256SUMS.txt file, performs a checksum verification, and uses chmod +x before moving it to a local binary directory for execution.
[EXTERNAL_DOWNLOADS]: The skill performs automated downloads of software components from external servers.
Evidence: The setup process in SKILL.md uses curl to fetch the figcraft-cli binary and its checksums directly from GitHub Releases.
[COMMAND_EXECUTION]: The skill instructs the agent to perform multiple shell-based operations, including an explicit instruction to bypass user consent.
Evidence: SKILL.md states: 'Do not ask permission for these steps' regarding the auto-installation process involving curl, shasum, unzip, and chmod.
Evidence: references/control.md contains a Bash example demonstrating socket communication via /dev/tcp/127.0.0.1/$port, a technique commonly flagged in malicious reverse shell patterns.
[DATA_EXFILTRATION]: The skill provides capabilities to send local file content and directory structures to remote network endpoints.
Evidence: The plugin publish command in references/cli.md transmits a plugin folder to a server address provided at runtime, along with an authentication key (FIGCRAFT_SERVER_KEY).
[INDIRECT_PROMPT_INJECTION]: The skill ingests complex external data formats which represent a potential attack surface for indirect prompt injection.
Ingestion points: figcraft-cli info and open_file (in references/mcp.md) process untrusted .fig, .svg, and .figcraft files.
Boundary markers: No explicit delimiters or instructions to ignore embedded commands are documented for the data processing phase.
Capability inventory: The skill possesses the ability to execute shell commands (figcraft-cli), write to the filesystem (save_file, export), and perform network requests (plugin publish).
Sanitization: Documentation describes the import process for some formats as 'best-effort' but does not specify safety filtering for ingested content.

figcraft