The Agent Skills Directory

[PROMPT_INJECTION]: The instructions and prompt templates (e.g., for storyboard generation and image creation) are focused on the skill's primary function of video production. No patterns aiming to bypass safety filters or override agent behavior were identified.
[CREDENTIALS_UNSAFE]: No hardcoded secrets or API keys are present. The documentation specifically instructs the agent not to manage sensitive keys for external services like MiniMax, directing the user to handle them instead.
[DATA_EXFILTRATION]: The skill does not access sensitive local file paths (such as .ssh or .env files) or attempt to send data to untrusted remote destinations. Network activity is limited to standard Node.js package resolution.
[REMOTE_CODE_EXECUTION]: The dependencies defined in package.json and package-lock.json consist of well-known libraries like Remotion and React. There are no patterns involving the download and execution of arbitrary scripts from untrusted sources.
[INDIRECT_PROMPT_INJECTION]: The skill ingests user-provided text (poems or idioms) to generate video compositions. While this is a data ingestion point, it is integral to the skill's intended purpose and does not involve interpolation into high-privilege execution contexts without oversight.
[OBFUSCATION]: All code and assets are provided in cleartext. Analysis of the source files revealed no use of hidden characters, multi-layer encoding, or homoglyph-based deception.
[EXTERNAL_DOWNLOADS]: Node.js dependencies are fetched from standard package registries and well-known mirrors. The skill does not download external executables or configuration files from unknown third-party domains.

guofeng-paper-video