The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill is designed to generate JavaScript modules that define animations. This code is intended to be executed within a sandboxed player environment. The skill uses JSON.parse for data handling and avoids unsafe deserialization methods.
[REMOTE_CODE_EXECUTION]: The skill provides a comprehensive Node.js script (render.mjs) for users to run animations locally. This script implements multiple security checks, including validating that no symbolic links or hard links are processed to prevent directory traversal or access to sensitive files, forcing network isolation in the Chromium browser instance using proxy and host-resolver flags, and sanitizing environment variables (NODE_PATH, NODE_OPTIONS) to prevent code injection into the Node.js runtime.
[INDIRECT_PROMPT_INJECTION]: The skill has an attack surface for indirect prompt injection as it processes external film data (JSON and JS modules). The instructions include explicit defensive strategies, such as treating existing film content as data rather than instructions and requiring the agent to inspect all content before modification or export.
Ingestion points: Reads film store documents (film/meta, modules/*) and assets.
Boundary markers: Execution is isolated in a sandboxed web stage and via the render.mjs security driver.
Capability inventory: Uses the Artifact and ArtifactData tools for database operations; instructs the user to run the rendering script in a local shell.
Sanitization: The render.mjs script performs extensive file system and environment validation.
[EXTERNAL_DOWNLOADS]: The skill references standard external dependencies, specifically playwright-core for local rendering and Google Fonts for typography. These are well-known services used for their intended purposes.

simple-animation