The Agent Skills Directory

[COMMAND_EXECUTION]: The skill relies on external CLI tools to perform media processing and rendering tasks. It calls ffmpeg for video encoding and audio mixing, ffprobe for metadata extraction, and chromium (or Google Chrome) in headless mode to rasterize SVG assets into PNGs. It also includes a fallback to ImageMagick's convert tool for icon processing.
[EXTERNAL_DOWNLOADS]: The skill interacts with several external services to fetch required assets and generate content. It calls OpenAI's API for TTS (narration), Whisper (word timestamps), and image generation (DALL-E). It also fetches SVG brand icons from the public registry at thesvg.org and downloads Lucide interface icons from cdn.jsdelivr.net to a local cache folder in the user's home directory (~/.cache/framesmith/lucide).
[CREDENTIALS_UNSAFE]: Hardcoded dummy credentials, including a Stripe secret key and a database connection string, are present in examples/prismor/brief.json. These are illustrative placeholders used in a sample video script about security vulnerabilities and do not represent a compromise of actual credentials.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from configuration files (brief.json) and script files (vo.txt) which are used to generate visual overlays and image generation prompts. 1. Ingestion points: Script content and asset prompts are read from the brief.json file. 2. Boundary markers: No explicit boundary markers or 'ignore embedded instructions' warnings are present in the rendering logic. 3. Capability inventory: The skill can execute shell commands via subprocess, perform network requests, and write to the local file system. 4. Sanitization: Commands are executed using list-based arguments to prevent shell injection, and text is rendered as static images, though prompt content is passed directly to external AI models.

narrated-collage-explainer