The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes complex, attacker-controllable data formats such as PSD, PSB, and JSON action sets, which presents a surface for indirect prompt injection. Maliciously crafted files could attempt to influence the agent's logic or bypass intended constraints.
Ingestion points: Data enters the agent's context through file opening commands (app.open, photocraft-cli convert), image processing tools, and the ingestion of batch action files (batch, droplet).
Boundary markers: The skill explicitly instructs the agent to use --automation-read-root and --automation-write-root flags to establish a directory-level security boundary for file operations.
Capability inventory: The skill allows for engine command execution, file system writes within the specified roots, and interaction with the system print spooler via lp or Windows-specific commands.
Sanitization: A comprehensive "fail-closed" security architecture is implemented, as verified in crates/automation/src/workspace.rs, which explicitly blocks ambient filesystem access and restricts sensitive command parameters.
[COMMAND_EXECUTION]: The skill relies on the execution of shell-based commands for its core functionality, including application management and CLI interactions.
Evidence: Instructions include the use of open -a PhotoCraft, photocraft-cli subcommands, and system-level printing via lp or the Windows spooler.
[EXTERNAL_DOWNLOADS]: The skill references downloading binary components and source code from an external repository not included in the pre-defined trusted organizations list.
Evidence: The skill directs users to the GitHub releases page for the storytold organization (github.com/storytold/photocraft) for downloading the CLI and other assets.
[DYNAMIC_EXECUTION]: The skill supports the installation and execution of WebAssembly-based plugins, which constitutes runtime dynamic code execution.
Evidence: PhotoCraft implements a Wasm plugin ABI (v1) using the wasmi interpreter. The implementation includes significant resource constraints, such as a 50M-instruction fuel limit and no access to network or filesystem APIs, to mitigate the risks associated with untrusted modules.

photocraft