The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The file references/craft-command-evidence.json specifies a download URL for a portable ZIP archive (https://github.com/storytold/effectcraft/releases/download/v0.10.0/effectcraft-0.10.0-windows-x64-portable.zip) containing the effectcraft-cli.exe binary. This source is not associated with a pre-verified trusted organization.- [REMOTE_CODE_EXECUTION]: Instructions in SKILL.md and references/craft-methods.md direct the agent to execute the effectcraft-cli binary with specific parameters to perform rendering and project manipulation. Running unvetted external binaries presents a high security risk as the code's behavior cannot be audited by the platform.- [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied project files (.ecproj) and media assets, which serves as a vulnerability surface for malicious data to influence the agent's behavior.
Ingestion points: Project files and media assets referenced during the export process.
Boundary markers: Absent. No specific instructions are provided to the agent to treat data inside the project files as untrusted.
Capability inventory: The agent has the ability to execute shell commands via the effectcraft-cli tool.
Sanitization: No evidence of validation or sanitization for content extracted from external project files.

effectcraft-motion-export