The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/scaffold_talking_head_remotion_project.py uses subprocess.check_output to execute the ffprobe binary on user-provided file paths to extract media duration.
[DYNAMIC_EXECUTION]: The replace_placeholders function in the scaffolding script performs direct string replacement of CLI arguments (such as --title) into the project's TypeScript template files (e.g., src/demoData.ts). This lacks proper escaping or sanitization, allowing a maliciously crafted project title to inject arbitrary code into the generated project's configuration.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted external data (scripts and media files) and use it to drive code generation. It lacks explicit instructions for the agent to sanitize these inputs or use boundary markers, creating a surface where malicious instructions embedded in the source script could influence the agent's behavior during project creation.
[FILE_SYSTEM_ACCESS]: The scaffolding script allows the agent to copy any file it has access to into a new project directory via the copy_optional function, which resolves and expands user-provided paths without restriction.

talking-head-remotion