The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The install command in scripts/video-motion-previs.mjs fetches an installation script from https://raw.githubusercontent.com/wassermanproductions/motion-previs-studio/main/install.sh and executes it via bash on macOS systems.
[EXTERNAL_DOWNLOADS]: The script performs a git clone from https://github.com/wassermanproductions/motion-previs-studio.git and runs npm ci to download and install application dependencies from an external Git repository.
[COMMAND_EXECUTION]: The skill executes various system-level commands including git, npm, and platform-specific application launchers (open on macOS, spawn for executables on Windows) to manage the installation and lifecycle of the Motion Previs Studio app.
[PERSISTENCE_MECHANISMS]: The link command creates a persistent symlink or command wrapper in the user's ~/.local/bin directory, effectively adding the CLI tool to the user's environment across sessions.
[DATA_EXPOSURE_AND_EXFILTRATION]: The skill accesses the control.json file in application data directories (e.g., ~/.config/motion-previs/ or %APPDATA%) to retrieve a bearer token used for local API communication with the Motion Previs Studio application.
[INDIRECT_PROMPT_INJECTION]: The skill exposes an attack surface by accepting external URLs in the import-url and workflow commands, which are then processed by the underlying application for video ingestion.
Ingestion points: import-url parameter and workflow URL argument in scripts/video-motion-previs.mjs.
Boundary markers: None present; the skill lacks delimiters or instructions to ignore embedded content within the source URL.
Capability inventory: The skill possesses capabilities for shell command execution, file system writes, and network requests via RPC.
Sanitization: No explicit validation or sanitization is performed on the URL input before it is passed to the application's control server.

video-motion-previs