The Agent Skills Directory

[COMMAND_EXECUTION]: The skill frequently uses execSync and npx to interact with system-level tools for media processing. It invokes ffmpeg and ffprobe for audio/video manipulation, npm for dependency management, and whisper for speech-to-text verification. These operations are core to the video production workflow.
[EXTERNAL_DOWNLOADS]: The skill fetches assets and data from external services. It makes API requests to ElevenLabs (api.elevenlabs.io) for high-quality voice synthesis and uses standard Node.js package managers to install tools like lucide-react and project templates via npx create-video@latest. These sources are well-known industry services.
[DATA_EXFILTRATION]: Through the discover-brand.ts script, the skill crawls local repository files—including package.json, README.md, and CSS configurations—to identify brand names, taglines, colors, and logos. While this involves reading local data, the information is processed locally by the agent to assist in video creation and is not sent to unauthorized external domains.
[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface (Category 8) because the discover-brand.ts script ingests content from external repositories (like README paragraphs) that are subsequently used to pre-populate the agent's creative prompts. Although there are no explicit sanitization layers or boundary markers for this untrusted data, the risk is categorized as low given the context of a developer-oriented automation tool.

promo-video