The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill implements a local TCP server in scripts/krita_bridge/krita_bridge.py that listens on port 8737 and executes arbitrary Python code received via HTTP POST requests. This bridge operates without authentication, allowing any local process to execute code with the user's privileges within the Krita application.
[DYNAMIC_EXECUTION]: The bridge script (scripts/krita_bridge/krita_bridge.py) uses compile() and exec() to run Python code payloads received over the local network connection. This allows for the dynamic execution of arbitrary instructions at runtime, which is a significant security risk as the input source is unauthenticated.
[COMMAND_EXECUTION]: The scripts/krita-install-bridge.sh script executes shell commands to copy plugin files into the user's application support directory (e.g., ~/Library/Application Support/krita/pykrita or ~/.local/share/krita/pykrita). It also executes an inline Python script using a heredoc to programmatically modify the kritarc configuration file.
[PERSISTENCE_MECHANISMS]: The scripts/krita-install-bridge.sh script establishes persistence by installing a Krita plugin and modifying the application's configuration to ensure the bridge starts automatically whenever the Krita application is launched by the user.

krita