The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses a Node.js client (scripts/client.mjs) to manage a local knowledge base and send commands to TouchDesigner. This involves file system operations (read/write) in the user's home directory.
[REMOTE_CODE_EXECUTION]: The Python extension assets/toe/src/TouchDesignerAPI.py provides an HTTP endpoint (/execute) that uses the Python exec() function to run arbitrary code received from the agent. This allows for dynamic control of the TouchDesigner process but also creates a local execution sink.
[DATA_EXFILTRATION]: The skill implements a persistent 'Personal Knowledge Base' in ~/.touchdesigner-skill/knowledge/. The agent is instructed to store and retrieve lessons here, which involves accessing the local file system.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it reads operator names, parameters, and network data from TouchDesigner projects. A maliciously crafted project could contain instructions within its metadata that the agent might inadvertently follow when processing project state.
Ingestion points: Data retrieved via pane, selection, operators, params, inspect, and network subcommands in scripts/client.mjs.
Boundary markers: The client script provides SHA256 hashes and size diagnostics for input code, but metadata retrieved from TouchDesigner is not wrapped in safety delimiters.
Capability inventory: The skill can execute arbitrary Python in the TouchDesigner process, perform local HTTP requests, and read/write to the local filesystem.
Sanitization: There is no evidence of sanitization or filtering of operator names or parameter values retrieved from the TouchDesigner bridge before they are analyzed by the agent.

touchdesigner