The Agent Skills Directory

[DYNAMIC_EXECUTION]: The bridge server component (scripts/zb_plugins/zb_bridge_server.py) uses exec() and compile() to execute Python code received over a local socket. This mechanism is central to the skill's ability to drive ZBrush's internal Python API for sculpting and modeling tasks.
[COMMAND_EXECUTION]: The launch and session management script (scripts/zb_launch.py) executes shell commands via subprocess.run(). Specifically, it uses pgrep for process monitoring and osascript (AppleScript) to automate macOS UI tasks, such as closing the ZBrush Home Page overlay and interacting with modal save dialogs.
[INDIRECT_PROMPT_INJECTION]: The skill processes external data sources including ZBrush activity logs and exported OBJ mesh files. While this creates an attack surface for indirect instructions, the skill implements specific parsing and objective auditing logic in scripts/zb_audit.py which limits the risk.
[SAFE]: All network operations are limited to localhost (127.0.0.1), ensuring that the execution bridge remains isolated from external network traffic. File system access is restricted to standard ZBrush application logs and user preference directories required for canonical path discovery.

scenario-zbrush-expert