The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill downloads binary artifacts, including the FilmCraft CLI and a macOS Desktop DMG, from the author's official GitHub repositories. All downloaded content is verified against hardcoded SHA256 checksums in lock files before use.
[COMMAND_EXECUTION]: Video editing operations are performed by invoking the FilmCraft CLI via subprocesses. These executions are strictly isolated using the macOS sandbox-exec utility, which enforces a deny-by-default policy, allowing the tool to access only required system libraries and specific directories explicitly authorized by the user.
[DYNAMIC_EXECUTION]: External binaries are dynamically downloaded and loaded at runtime. The skill implements proactive checks to ensure binaries are correctly signed, correspond to the expected architecture (arm64), and match the vendor's identity before any execution occurs.
[REMOTE_CODE_EXECUTION]: Although the skill downloads and executes code from remote sources, the finding is evaluated as safe. It targets established developer repositories, performs rigorous integrity and signature validation, and leverages operating system isolation primitives to prevent unauthorized activities.
[INDIRECT_PROMPT_INJECTION]: The skill's ingestion of external project files represents a potential attack surface. This is mitigated through strict JSON parsing that rejects duplicate keys and non-finite values, comprehensive parameter validation against a known command catalog, and the application of process-level sandboxing to contain any potential exploitation.

filmcraft-cli