The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill references and fetches workflow definitions and documentation from external GitHub repositories.
Evidence: references/workflow-sources.json points to raw.githubusercontent.com/darktable-org/dtdocs and github.com/storytold/lightcraft to establish the logic for history stacks and library backups.
[INDIRECT_PROMPT_INJECTION]: The skill processes external data from a photo catalog which could theoretically contain malicious instructions if the metadata or IDs are compromised, though the impact is limited to the photo editing context.
Ingestion points: Results from catalog.query and develop.get in references/craft-steps.json.
Boundary markers: The skill instructions in references/craft-methods.md emphasize checking for ok and error responses and validating that IDs are integers.
Capability inventory: The skill can read photo settings (develop.get), modify settings (develop.paste), and write files to the local system (app.export).
Sanitization: Instructions require that ID inputs be "non-empty flat integer arrays" to prevent unexpected command behavior.
[REMOTE_CODE_EXECUTION]: The skill suggests installing an additional component via npx from the same vendor.
Evidence: SKILL.md contains the command npx skills add full-aigc-skills/lightcraft-skills --skill lightcraft-editor. This is a vendor-owned resource used for extending the skill's functionality.

lightcraft-tone-curve-transfer