The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes local Python scripts (project_tool.py, dashboard_server.py) to manage project states and host a creator dashboard. These executions are scoped to the skill's own directory and the user-provided workspace.- [DATA_EXPOSURE]: The skill hosts a local HTTP dashboard server. It binds strictly to the loopback interface (127.0.0.1) and implements security controls such as unique session tokens, API prefixes, and Content Security Policy (CSP) headers to prevent unauthorized access or cross-site scripting.- [DYNAMIC_EXECUTION]: The dashboard server dynamically loads the project_tool.py module at runtime to share logic. This is implemented using standard Python dynamic import mechanisms targeting local skill files.- [INDIRECT_PROMPT_INJECTION]: The skill processes user-generated content in project files (e.g., Markdown scripts, JSON assets). While these could contain malicious instructions, the skill defines strict ownership boundaries and structural validation in its scripts to minimize the impact on agent behavior.- [COMMAND_EXECUTION]: The project management tool uses atomic filesystem operations with directory-level locking to ensure data integrity and prevent race conditions during file publication and packaging.

short-drama