The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The setup.sh script downloads a binary plugin file (twozero.tox) from https://www.404zero.com/pisang/twozero.tox. While this is the primary component for the skill's functionality, it involves downloading and installing an external binary from a third-party vendor site.
[COMMAND_EXECUTION]: The scripts/setup.sh script executes various shell commands, including curl for downloads, pgrep for process checking, and a Python one-liner to programmatically modify the Hermes config.yaml file to register the new MCP server.
[REMOTE_CODE_EXECUTION]: The skill implements the td_execute_python tool, which allows the agent to run arbitrary Python code within the TouchDesigner process. This provides full access to the TouchDesigner API and the local filesystem under the privileges of the TouchDesigner application user.
[INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface for indirect prompt injection because it reads external data (scripts, console logs, and channel values) and has powerful execution capabilities.
Ingestion points: Data is ingested via td_read_dat, td_read_textport, td_read_chop, and td_search (as defined in references/mcp-tools.md).
Boundary markers: The instructions do not specify the use of boundary markers or delimiters when the agent processes the ingested data.
Capability inventory: The skill can execute Python (td_execute_python), write files (td_write_dat), and create operators (td_create_operator).
Sanitization: There is no evidence of sanitization or validation of the data read from TouchDesigner before it is interpolated into prompts or used in logic.
[PROMPT_INJECTION]: The SKILL.md file contains "CRITICAL RULES" that use imperative language ("NEVER", "STOP", "ALWAYS") to override default agent reasoning. While intended for reliability, these follow the pattern of instructions meant to constrain the model's behavior.

touchdesigner-mcp