The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill provides instructions in references/installation.md for the agent to download the Tesseract CLI binaries and associated checksum files from the author's public GitHub repository at github.com/mirage-hq/tesseract.
[REMOTE_CODE_EXECUTION]: Following the download, references/installation.md instructs the agent to execute an installation script (install.sh on macOS or install.ps1 on Windows) contained within the downloaded archive. This pattern involves executing code retrieved from a remote source.
[PRIVILEGE_ESCALATION]: The Windows installation procedure explicitly uses powershell -ExecutionPolicy Bypass to run the installer script, which bypasses local security configurations intended to restrict script execution.
[COMMAND_EXECUTION]: Local Python scripts scripts/tesseract_media.py and scripts/tesseract_sound.py use subprocess.run to execute shell commands. These commands are primarily used to invoke ffmpeg and ffprobe for media processing and metadata extraction tasks.
[DYNAMIC_EXECUTION]: The skill supports the use of custom WGSL shaders (references/custom-shader.md) and JavaScript-based procedural animators (references/motion.md). These scripts are intended to be executed at runtime by the Tesseract engine to drive visual effects and motion.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data by importing video, audio, and font files. It extracts metadata from these assets and incorporates them into Tesseract project files. This creates an attack surface where maliciously crafted media metadata could potentially influence the agent's behavior or the project's state. The instructions emphasize schema validation, which provides some mitigation against malformed project data.

tesseract-motion