Photoshop Automator

Automate Adobe Photoshop on Windows via ExtendScript to run scripts, update text layers, create layers, apply filters, play actions, and export images.

Security Scan

The skill's code and instructions are consistent with a Photoshop ExtendScript automation tool, but it exposes the expected powerful capability to run arbitrary JSX (which can read/write the filesystem) and contains a small metadata inconsistency; review scripts and trust the source before use.

Purpose & Capability

Name/description match the implementation: the package executes ExtendScript (JSX) in Photoshop via cscript (Windows) or osascript (macOS), and provides helpers (updateText, createLayer, applyFilter, playAction, export). The handlers and SKILL.md align with this purpose.

Instruction Scope

runScript deliberately executes arbitrary ExtendScript supplied as input. SKILL.md warns that ExtendScript has direct filesystem access and that generated scripts must be reviewed. That is expected for a Photoshop automation skill, but it is a powerful capability: untrusted JSX can create/modify/delete local files (and ExtendScript may be able to use socket/IO features). The skill does not attempt to read unrelated system files or contact external endpoints itself.

Install Mechanism

No install/download behavior is present (instruction-only with packaged handler code). There are no external URL downloads or archive extracts. The code writes temporary files (JSX/VBS) and executes local commands, which is expected for this functionality.

Credentials

No credentials or env vars are requested (appropriate). However the declared required binaries list (cscript, osascript) is inconsistent with OS targeting: the package metadata claims both binaries must exist but the code chooses cscript on Windows and osascript on macOS. Requiring both on every install is disproportionate and will be incorrect on typical systems. The skill also writes to the system temp directory and can write to arbitrary output paths supplied to export or JSX—this is expected but should be used with care.

Persistence & Privilege

The skill does not request always:true, does not persist credentials, and does not modify other skills or system-wide settings. It executes only when invoked and cleans up temporary files (best-effort).

Assessment

This skill legitimately runs user-provided ExtendScript in Photoshop and therefore can read and write local files — that is the intended functionality but also a real risk. Only install/use it if you trust the skill and the scripts you run. Before enabling or allowing autonomous use: 1) Verify the skill source (registry lists 'unknown' homepage; package files reference a GitHub repo—confirm the upstream repo and author). 2) Do not run unreviewed JSX; inspect any generated or supplied scripts. 3) Consider restricting agent autonomous invocation for this skill (disable autonomous runs) so scripts only run with your explicit approval. 4) Be aware export paths and temporary files may overwrite or leave artifacts; run initially in a safe/test environment (or VM) and limit file paths and permissions where possible. 5) Notify maintainers to fix metadata that requires both cscript and osascript unconditionally, since that is incorrect for typical single-OS hosts.

Photoshop Automator Skill (v1.2.4)

This skill provides a high-performance bridge for automating Adobe Photoshop (vCS6 - 2026+) on Windows and macOS using the ExtendScript (JSX) engine via VBScript or AppleScript.

Commands

• runScript: Executes raw ExtendScript (ES3) code. Use this for complex document manipulation.
• updateText: Target a specific text layer by name and update its contents instantly.
• createLayer: Create new art layers with custom opacity and blending modes.
• applyFilter: Apply a professional Gaussian Blur filter to the active layer.
• playAction: Play recorded Photoshop actions (.atn) by name and set.
• export: Save the active document as a high-quality PNG or JPEG.

🛠 AI Protocol

1. Technical Constraints (Strict)

• ES3 Syntax Only: Photoshop's ExtendScript engine uses ECMAScript 3 (ES3).
  • ❌ DO NOT USE: const, let, arrow functions () => {}, template literals `${}`, or Map/Set.
  • ✅ USE: Only var, standard function declarations, and string concatenation ('a' + b).
• Assume Active Document: Commands operate on the active document. If none is open, scripts will fail unless they call app.documents.add().

2. Security & Side Effects

• Filesystem Access: The runScript command allows execution of arbitrary ExtendScript. This engine has direct access to the host filesystem.
• Side Effects: Scripts can create, modify, or delete files on the local machine via the File and Folder objects.
• Verification: Always review dynamically generated scripts before execution to prevent unintended document or filesystem modifications.

3. Error Handling

• GUI Blocks: If Photoshop has a modal dialog open (e.g., Save As window, error popup), COM operations will hang or fail. Direct the user to close any open dialogs.
• Layer Presence: If updateText fails, ensure the layer name provided matches exactly (case-sensitive) with the layer in the PSD.

Setup

Ensure Adobe Photoshop is installed on the host system. The skill automatically uses the registered COM server.

---

Developed for the OpenClaw community by Abdul Karim Mia.