The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill is designed to download the PhotoCraft CLI and desktop components from official vendor sources. It enforces integrity by checking artifacts against pinned SHA-256 hashes before any installation or execution.
[COMMAND_EXECUTION]: Native commands are executed through a Python-based harness using isolated environments (python3 -I -B). This prevents the CLI from inheriting unsafe environment variables or generating unauthorized bytecode.
[INDIRECT_PROMPT_INJECTION]: The skill has an attack surface as it processes external JSON plans and user assets. However, it implements robust security boundaries: 1) Ingestion points: Operations are defined in structured JSON files; 2) Boundary markers: The skill uses strict JSON parsing (rejecting duplicate keys and non-finite values) and validates tool schemas against a capability snapshot; 3) Capability inventory: Subprocess execution is restricted to the native CLI, and filesystem access is scoped to authorized directories; 4) Sanitization: The skill performs path validation to prevent directory traversal and checks for missing fonts.
[SAFE]: No malicious patterns such as credential theft, persistence, or obfuscation were identified. The documentation emphasizes state verification, journaling, and human-in-the-loop checkpoints for creative approval.

photocraft-cli-adjustments