The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill setup process involves automated downloads of binary EffectCraft CLI artifacts and AI tracking models (face and roto models) using system tools like curl. These resources are fetched from an unverified third-party repository (github.com/storytold/effectcraft) and vendor-owned accounts not included in the trusted provider list.
[REMOTE_CODE_EXECUTION]: The skill utilizes a bootstrap.py script to download, verify, and initialize native binary executables on the host machine. This mechanism executes externally sourced binary code as a prerequisite for skill operation.
[COMMAND_EXECUTION]: The skill provides a high-risk file.executeFile command that allows the agent to execute arbitrary files on the local system. It also relies on shell and PowerShell scripts (launch.sh, launch.ps1) for environment management and engine orchestration.
[DYNAMIC_EXECUTION]: The skill exposes multiple interfaces for dynamic code execution, including script.run for executing arbitrary JavaScript code and file.runScript for processing external script files or batch command lists.
[INDIRECT_PROMPT_INJECTION]: The skill has a high vulnerability surface for indirect prompt injection. It ingests untrusted data from project files and media (via file.import and open_project in references/commands.json) and lacks sanitization or boundary markers when processing this data in conjunction with high-privilege capabilities like JavaScript execution (script.run in references/commands.json).

effectcraft-use