The Agent Skills Directory

[DYNAMIC_EXECUTION]: The script scripts/pace.py dynamically modifies the Python search path (sys.path) to include directories within the user's home folder (~/.claude/skills/...). This allows the script to import modules from computed paths, which is a common pattern for skill integration but poses a risk if an attacker can write to those directories.
[DYNAMIC_EXECUTION]: The skill uses runtime generation and execution of instructions. Specifically, scripts/pace.py generates a temporary .jsonl file containing editing commands which is then executed by the FilmCraft CLI tool.
[COMMAND_EXECUTION]: The script invokes an external CLI tool (fc.CLI) using subprocess.run to perform media export and project manipulation. While arguments are passed as a list, this involves executing system commands based on script logic and project data.
[INDIRECT_PROMPT_INJECTION]: The skill has a surface for indirect prompt injection as it processes external project files (.fcproj).
Ingestion points: FilmCraft project files are loaded and parsed in scripts/pace.py using fc.inspect and json.loads.
Boundary markers: No explicit boundary markers or instruction-ignore warnings are used when processing project data.
Capability inventory: The skill can read/write files and execute CLI commands through subprocess.run and the fc module.
Sanitization: Project data is parsed as structured JSON, but values extracted from the project are not specifically sanitized before being used in logic or reports.

filmcraft-pacing