The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses osascript and bash to interface with macOS and Adobe After Effects. osascript is a high-privilege tool that can control system applications and execute shell commands via do shell script, posing a risk if the executed content is compromised.
[REMOTE_CODE_EXECUTION]: The skill's core workflow involves generating .jsx scripts at runtime and executing them using osascript. This dynamic execution of generated code is a classic remote code execution (RCE) vector. If untrusted data (such as project metadata or user-supplied strings) is interpolated into these scripts without rigorous sanitization, it could lead to the execution of malicious logic within the After Effects environment.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it ingests project state (layer names, composition names, expressions) from After Effects to guide the agent's actions. Maliciously crafted data within an AE project could influence the agent's behavior or poison the generated action scripts.
Ingestion points: Project data is ingested through scripts/active-state.jsx and scripts/project-overview.jsx, with results stored in /tmp/ae-assistant-result.json for agent consumption.
Boundary markers: The instructions do not define boundary markers or provide warnings to the agent to treat ingested project data as untrusted.
Capability inventory: The skill possesses the capability to write files and execute scripts through osascript, providing a direct path from injection to execution.
Sanitization: There is no evidence of sanitization or escaping mechanisms being used for data retrieved from the project before it is used in subsequent script generation.

after-effects