The Agent Skills Directory

[PROMPT_INJECTION]: The skill instructions include a defensive check against prompt injection from external data sources. It explicitly tells the agent to treat fetched text as untrusted and to ignore common override patterns like 'ignore previous instructions'.
[REMOTE_CODE_EXECUTION]: The skill uses npx --no-install remotion render to perform rendering. The --no-install flag prevents the execution of arbitrary remote code by ensuring only locally staged dependencies are used.
[DATA_EXFILTRATION]: Video delivery is handled through a local notify tool (sending to Telegram) and by committing to the repository (GitHub). These are intentional output channels and do not involve unauthorized exfiltration of sensitive data.
[INDIRECT_PROMPT_INJECTION]: The skill fetches untrusted data from the web. It mitigates the risk by instructing the agent to never follow instructions embedded in that data and to discard content that attempts to override system rules.
Ingestion points: WebSearch and WebFetch results.
Boundary markers: Explicit instructions to treat fetched text as untrusted and ignore overrides.
Capability inventory: Shell execution for rendering (npx), file writing (props.json, logs, memory), and network access (Telegram notify via CLI).
Sanitization: Human-readable instructions for the agent to filter untrusted content before interpolation into the storyboard.

remotion