The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted input from STORYBOARD.md, narration/script.json, and episode.json files. These inputs are used to drive the video build process and are passed to parallel sub-agents (e.g., papercut-scene). There are no explicit boundary markers or sanitization steps described to prevent malicious instructions within these data files from influencing the agents or the generated code output.
Ingestion points: STORYBOARD.md, narration/script.json, and episode.json (referenced in SKILL.md).
Boundary markers: Absent.
Capability inventory: Execution of various shell, Python, and Node.js scripts (new_episode.sh, render.sh, stubs.py, render.mjs) and sub-agent spawning.
Sanitization: Absent.
[DYNAMIC_EXECUTION]: The skill generates source code dynamically during the workflow. Specifically, stubs.py creates src/scenes/index.ts and scene stubs, and sub-agents are expected to write React component files (src/scenes/<Scene>.tsx). While this is central to the skill's purpose, it creates a surface for code injection if the inputs or templates are manipulated.
[COMMAND_EXECUTION]: The skill relies heavily on the execution of local scripts (Shell, Python, and Node.js) located within the path defined by the $PAPERCUT_LIB environment variable. These scripts manage project scaffolding, audio/video rendering, and asset harvesting.
[EXTERNAL_DOWNLOADS]: The skill instructions involve downloading external resources, such as the remotion-dev/skills package via npx and headless Chrome for rendering. Additionally, the capture.mjs tool fetches content from arbitrary user-provided URLs to generate asset screenshots, which could be misused for server-side request forgery (SSRF) or information gathering if the browser environment is not properly isolated.

papercut-build