The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill specifies a download location for the designcraft-cli.exe binary from a GitHub repository (storytold/designcraft) and includes a SHA256 hash to allow for integrity verification of the downloaded file.
[COMMAND_EXECUTION]: The skill provides procedures for the agent to execute local Python scripts (brochure_input.py, write_script.py) and the external designcraft-cli.exe utility to transform data into design documents and PDFs.
[INDIRECT_PROMPT_INJECTION]: The skill has an attack surface for indirect prompt injection as it ingests and processes product data provided by users or external sources. (1) Ingestion points: Product names, descriptions, and other details are read from input JSON files via the scripts/brochure_input.py script. (2) Boundary markers: The skill relies on data structure (JSON) for isolation but does not use explicit natural language delimiters to signal the start and end of untrusted content to the model. (3) Capability inventory: The skill can perform file system writes, execute local scripts, and run the DesignCraft CLI tool. (4) Sanitization: Validation is performed in scripts/brochure_input.py, including checks for text length, currency format, and path traversal prevention for image references.

designcraft-brochure