The Agent Skills Directory

[COMMAND_EXECUTION]: The provided render.mjs script utilizes node:child_process.spawn to execute the ffmpeg binary for video encoding and audio merging. This is a standard method for media processing but involves the execution of external binaries.
[DYNAMIC_EXECUTION]: The skill generates a complete HTML/JavaScript application at runtime, which is then executed within a Playwright (Chromium) browser instance to render individual frames for the final video output. This involves the execution of dynamically generated code based on user and external inputs.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to fetch and process data from user-provided URLs to determine product features, UI labels, and branding. This creates a vulnerability surface where malicious content on a target website could attempt to influence the agent's code generation.
Ingestion points: URL content fetching described in SKILL.md (Step 1: "read it (web fetch) for the product's real wording").
Boundary markers: Includes instructions such as "Never invent facts" and "Only the product is required" to constrain the agent's output.
Capability inventory: File system writes, shell command execution via ffmpeg, and browser execution with local file access.
Sanitization: No explicit sanitization, escaping, or schema validation of fetched URL content is defined before it is interpolated into the generated HTML/JS rendering script.
[EXTERNAL_DOWNLOADS]: The skill requires the installation of the playwright package via npm and suggests fetching remote fonts (e.g., Google Fonts) to be inlined as base64. These resources originate from well-known services or are essential to the primary task.
[DATA_EXPOSURE]: The rendering script render.mjs launches the Chromium browser with the --allow-file-access-from-files flag enabled. This configuration permits the browser context to read local files, which could be exploited if the generated HTML incorporates untrusted or malicious scripts derived from the external content ingestion.

explainer-default