The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill downloads the filmcraft-cli binary and the FilmCraft desktop application from GitHub repositories (github.com/storytold/filmcraft and github.com/full-aigc-skills/filmcraft-skills). These downloads are verified against hardcoded SHA-256 hashes in runtime.lock.json and desktop.lock.json to ensure integrity.
[COMMAND_EXECUTION]: The skill uses Python's subprocess module to execute the downloaded binaries for media processing, frame rendering, and metadata inspection. It also invokes system utilities like hdiutil for DMG mounting and codesign for identity verification.
[SANDBOXING]: To mitigate risks from running external binaries, the skill implements a macOS sandbox using sandbox-exec. This restricts the process's capabilities, limiting network access and file system operations to only those directories explicitly authorized by the user as read-root or write-root.
[INDIRECT_PROMPT_INJECTION]: The skill processes structured data from user-supplied JSON plans and project files.
Ingestion points: JSON workflow plans and .fcproj project files ingested via workflow.py and commands.py.
Boundary markers: Strict JSON parsing and validation against a hardcoded command catalog (commands.json).
Capability inventory: File exporting, timeline manipulation, subtitle generation, and media rendering.
Sanitization: All parameters are validated against a fixed schema, and time-based values are enforced as strict 64-bit integers to prevent injection via malformed numeric inputs.

filmcraft-cli-export