The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill downloads its core native CLI binary from GitHub releases (github.com/storytold/designcraft or github.com/full-aigc-skills/designcraft-skills). This download is performed by scripts/bootstrap.py and is protected by mandatory SHA-256 checksum verification of both the archive and the resulting binary, preventing the execution of unverified or tampered code.
[COMMAND_EXECUTION]: The skill executes the downloaded native binary to perform export tasks such as PDF, IDML, and EPUB generation. Execution is handled via Python's subprocess.run using argument lists rather than shell strings, which effectively eliminates the risk of shell command injection.
[DYNAMIC_EXECUTION]: Several scripts within the skill (cli.py, business_evidence.py, commands.py) utilize importlib.util to load internal helper scripts from the local directory. This is used for modularity and is safely restricted to the skill's own file structure.
[SAFE]: The skill implements a robust manifest and evidence system (including artifact_manifest.py, business_evidence.py, and revision_evidence.py). These tools validate the identity, size, and SHA-256 hashes of delivered files and track project state across revisions, ensuring transparency and accountability for all file system operations performed by the CLI.

designcraft-cli-export