The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill automates the installation of its native CLI and specific AI models (such as Roto Brush and Face Tracking). These downloads are performed by internal scripts (e.g., bootstrap.py, desktop.py) and are strictly verified against hardcoded SHA256 hashes (runtimeSha256, desktopBinarySha256) to ensure supply chain integrity. All resources originate from the vendor's own infrastructure.
[DYNAMIC_EXECUTION]: The skill leverages the media engine's native scripting capabilities, providing a run_script command for After Effects-style JavaScript execution and a prop.setExpression command for property-level logic. It also includes a file.executeFile command for running external files. These are documented features of the media editing platform and are used within a managed task context.
[COMMAND_EXECUTION]: Shell scripts (launch.sh, launch.ps1) and Python scripts are used to manage project lifecycles. The skill explicitly enforces a policy of not modifying the global system PATH and scopes its execution to user data directories (e.g., ~/.agents/skills/).
[INDIRECT_PROMPT_INJECTION]: As the skill processes external project files and media assets, it is theoretically exposed to indirect prompt injection. However, it implements significant mitigations including structural validation of JSON commands, rejection of unknown fields by the native engine, and mandatory verification of project digests (expectedProjectSha256) before performing modifications.

effectcraft-cli-expressions