The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The file references/craft-command-evidence.json specifies a download for a binary executable (cadcraft-cli.exe) from the repository github.com/storytold/cadcraft. This repository is not included in the trusted vendors list, and downloading and using external binaries from non-standard sources poses a security risk.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process external CAD data (such as DXF files), which could contain malicious instructions embedded in metadata or labels designed to influence agent behavior.
Ingestion points: Processes CAD files through the open/new_drawing method and inspects entity data using drawing.inspect as defined in SKILL.md and references/craft-steps.json.
Boundary markers: The skill does not define specific delimiters or instructions to ignore potential commands embedded within the CAD data.
Capability inventory: The skill includes the ability to execute shell commands via cadcraft-cli, perform CAD operations through an execute tool, and write files using save and plot methods.
Sanitization: There is no evidence of sanitization or validation performed on the ingested CAD data before it is used in command parameters.
[COMMAND_EXECUTION]: The skill provides templates and instructions for the agent to run command-line operations using cadcraft-cli and an execute MCP tool to manipulate drawing files (SKILL.md, references/craft-methods.md).

cadcraft-sheet-export