The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill fetches resources from established and trusted services as part of its normal operation.
Downloads the Kokoro voice model (approx. 90MB) from Hugging Face (huggingface.co) upon the first invocation of the voiceover feature.
Installs required Node.js packages from the official NPM registry during the environment setup process.
[COMMAND_EXECUTION]: Subprocesses are used for core rendering tasks and environment management.
Spawns ffmpeg to encode captured browser frames into the final MP4 video output and to perform audio mixing.
Uses npm and npx commands for dependency installation and to manage the Playwright browser environment.
[INDIRECT_PROMPT_INJECTION]: The skill processes specifications provided in JSON format, which could contain untrusted data.
Ingests user-controlled data via motion.json used by scripts/check.mjs and scripts/render.mjs to generate content.
Mitigates potential risks through the use of strict boundary markers in instructions, a Content Security Policy that limits script execution, and a network guard that blocks all external requests during the rendering process.
[DATA_EXFILTRATION]: Multiple layers of protection are implemented to prevent unauthorized data access or transmission.
The preview server is restricted to the local interface (127.0.0.1) and validates Host headers to mitigate DNS rebinding.
Asset path resolution in scripts/lib/paths.mjs strictly enforces that all referenced files remain within the project's spec directory, preventing directory traversal attacks.

make-motion