The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill automates the download and installation of the PhotoCraft CLI and desktop application binaries from an upstream GitHub repository. It employs rigorous integrity checks, including architecture verification (macOS arm64) and pinned SHA-256 binary digests, to ensure that only authorized and uncorrupted artifacts are executed.
[COMMAND_EXECUTION]: It uses local shell commands via Python (python3 -I -B) to execute setup, CLI interface, and workflow management scripts. These operations are scoped to a specific harness directory and do not modify the system PATH or require administrative privileges.
[INDIRECT_PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface as it ingests and processes untrusted project files (.pcraft) and image assets.
Ingestion points: Untrusted data enters the agent context through the reading of existing project documents and external asset placement (asset.place).
Boundary markers: The skill uses structured JSON plans with explicit schema definitions and $ref object bindings to separate instructions from data.
Capability inventory: Key capabilities include file system writes (doc_save), local command execution (native.command), and plugin installation.
Sanitization: All inputs are subjected to checksum validation, and execution plans undergo schema verification before processing.
[DYNAMIC_EXECUTION]: The tool catalog documents a plugin.install command, which allows the dynamic loading of WASM-based modules. While this facilitates feature extension, the skill treats these as native components within its verified catalog and maintains isolation through a dedicated runtime environment.

photocraft-cli-setup