The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The "scripts/setup.sh" script downloads an executable TouchDesigner component ("twozero.tox") from "https://www.404zero.com/pisang/twozero.tox". This domain is a third-party site not included in the trusted vendor list.
[REMOTE_CODE_EXECUTION]: The "td_execute_python" tool allows for the execution of arbitrary Python scripts within the TouchDesigner process. This provides full access to the TouchDesigner API and the local filesystem with the permissions of the user running TouchDesigner.
[COMMAND_EXECUTION]: The skill provides the "td_input_execute" tool, which can simulate mouse and keyboard events on the host system, including clicking, typing, and scrolling. This requires accessibility permissions on macOS.
[DATA_EXFILTRATION]: The "td_test_session" tool includes functionality to export chat transcripts and submit reports, including project files, to a remote 'vendor hub'. This represents a mechanism for sensitive session data or local files to be sent to a third party.
[PRIVILEGE_ESCALATION]: The "references/external-data.md" file suggests using "chmod 666" on serial device paths in "/dev/" to bypass permission restrictions on macOS.
[DATA_EXPOSURE]: The skill includes tools such as "td_get_screen_screenshot" and "td_get_screenshot" which allow the agent to capture images of the user's screen or specific application windows, potentially exposing sensitive information.

touchdesigner-mcp