The Agent Skills Directory

[COMMAND_EXECUTION]: The skill invokes ffmpeg using os.system in main.py and subprocess in timeline.py and motion.py. These calls are intrinsic to its function as a video rendering engine. However, the os.system call in main.py constructs a command string using filenames from the brief.json configuration without sanitization, which could allow command injection if the configuration is sourced from an untrusted party.
[EXTERNAL_DOWNLOADS]: Fetches SVG icons and JSON metadata from well-known services and public repositories, including cdn.jsdelivr.net and raw.githubusercontent.com. It also performs legitimate API requests to OpenAI for image generation, text-to-speech, and transcription. These are functional requirements for the skill's media generation capabilities.
[INDIRECT_PROMPT_INJECTION]: The skill processes user-provided vo.txt scripts and brief.json configurations.
Ingestion points: main.py reads these files to define video content and structure, specifying timestamps and asset names.
Boundary markers: No explicit delimiters or safety instructions are used when processing these inputs before passing them to APIs or shell commands.
Capability inventory: Media encoding via ffmpeg execution and headless browser rendering via chromium are available to the skill.
Sanitization: There is no validation or escaping of the configuration values before they are incorporated into shell commands in main.py.
[DYNAMIC_EXECUTION]: Generates temporary HTML wrappers to render SVGs using a headless browser (chromium), allowing for the conversion of vector graphics to pixel-based sprites. This is a standard approach for high-quality SVG rasterization but involves executing a browser on local files.

animated-character-explainer