The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill downloads machine learning models from Hugging Face (e.g., whisper-tiny) using specific commit hashes for verification, which is a well-known service.
[EXTERNAL_DOWNLOADS]: It facilitates the installation of domain-specific extensions using npx skills add targeting the full-aigc-skills organization, which corresponds to the skill's author.
[COMMAND_EXECUTION]: The skill frequently executes local Python scripts such as bootstrap.py, workflow.py, and cli.py to manage the lifecycle of media projects and dependencies. These operations are performed using the system shell with specified arguments.
[INDIRECT_PROMPT_INJECTION]: The skill processes complex JSON data structures and external media assets (video, audio, images) which serve as an ingestion point for untrusted data.
Ingestion points: Data enters the agent context through JSON workflow plans (e.g., brand-campaign.json) and media files provided as assets.
Boundary markers: The system employs strict SHA-256 checksum verification for both workflow plans and output artifacts to ensure integrity.
Capability inventory: The skill has the capability to execute subprocesses, perform file system operations within project directories, and make network requests for model downloads.
Sanitization: External inputs are validated against fixed schemas (e.g., craft-skill-workflow/v1) and historical digests to prevent unauthorized modifications.

artcraft-cli-review