The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses subprocess.run and subprocess.Popen in scripts/ulanzi.py to manage the Ulanzi Studio lifecycle (starting and stopping the application). It also executes local PowerShell scripts in the scripts/win/ folder to perform platform-specific tasks like finding installed apps, capturing window screenshots via C# shims, and extracting shell icons.
[EXTERNAL_DOWNLOADS]: The scripts/win/install.ps1 script downloads the Ulanzi Studio installer for Windows from Ulanzi's official CDN. The script includes a critical safety check that verifies the Authenticode signature of the downloaded binary, ensuring it is signed by 'Shenzhen Ulanzi Technology Co., Ltd.' before execution. Additionally, scripts/ulanzi.py can fetch key icons from HTTPS URLs specified in layout files, with size and timeout constraints.
[PRIVILEGE_ESCALATION]: The installation process for the Ulanzi Studio software involves running an installer binary that may require administrative privileges (UAC prompt) to modify system files and registries. The skill also requires an execution policy bypass to run its PowerShell helper scripts.
[INDIRECT_PROMPT_INJECTION]: The skill processes external JSON layout files which could originate from untrusted sources. Although the Python script validates fields, performs regex checks on IDs, and highlights potentially 'risky' keys (such as those executing shell scripts or typing text) for user review, these files represent an attack surface where malicious instructions could be embedded in labels or parameters to influence the agent.
[PERSISTENCE]: The skill documents an optional integration with an AI-agent status monitor (ustudio-cli) that modifies local configuration files for various AI agents (e.g., ~/.claude/settings.json) to register hook commands. The instructions explicitly mandate obtaining user consent and creating backups before these modifications are performed.

ulanzi-deck