The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill downloads a fixed CLI runtime during its installation process. The installer performs architecture verification for macOS arm64 and validates the binary against a pinned SHA-256 digest in the lock file.
[COMMAND_EXECUTION]: Execution is performed through a set of local Python scripts that interface with the graphics tool. These scripts are provided by a dedicated harness dependency, ensuring the agent uses controlled execution paths.
[INDIRECT_PROMPT_INJECTION]: The skill ingests and processes potentially untrusted data from user projects and graphic assets. This category flags the presence of an attack surface rather than confirmed malicious intent.
Ingestion points: Operations involve reading JSON plans and vector project files (.vectorcraft) via script arguments.
Boundary markers: All inputs are subject to a 64MiB size limit and mandatory SHA-256 integrity checks.
Capability inventory: The skill can write project updates and export files to a designated output directory and execute a restricted set of vector commands via subprocesses.
Sanitization: A mandatory check phase validates the JSON plan structure and ensures that only commands from a pre-defined allowed list are executed.
[DYNAMIC_EXECUTION]: The skill uses structured JSON plans to define sequences of graphic operations. This execution is managed by the workflow helper which restricts activity to established command schemas, preventing the execution of arbitrary or unverified code.

vectorcraft-cli-boolean