The Agent Skills Directory

[COMMAND_EXECUTION]: The engine heavily utilizes subprocess to interface with system utilities such as ffmpeg, ffprobe, and Chromium. These calls are legitimate and necessary for video encoding, audio muxing, and rasterizing SVG icons into the final film frames.
[EXTERNAL_DOWNLOADS]: The skill downloads SVG icons and metadata from well-known repositories like JSDelivr (cdn.jsdelivr.net) and thesvg.org. It also makes authorized API calls to api.openai.com to perform text-to-speech synthesis and image generation based on instructions in the project brief.
[INDIRECT_PROMPT_INJECTION]: The skill features an attack surface for indirect prompt injection via user-controlled data files.
Ingestion points: brief.json and assets.json provide the copy and visual prompts used during the rendering process.
Boundary markers: Prompts are constructed using string interpolation with some instructional framing (e.g., 'Keep the exact same character design...').
Capability inventory: The skill can execute shell commands via subprocess for media processing and perform network requests to OpenAI APIs.
Sanitization: There is no explicit sanitization of the JSON content before it is interpolated into prompts or rendered as text in the video frames.
[CREDENTIALS_SAFE]: Sensitive information such as OpenAI API keys is retrieved from environment variables rather than being hardcoded, following security best practices.

cartoon-launch-film