The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted user data, including command names and one-line descriptions, which are then incorporated into a generated HTML file.
Ingestion points: User-provided command list and descriptions requested in Step 1.
Boundary markers: No explicit instructions for delimiters or safety warnings are provided for the generated HTML output.
Capability inventory: The skill instructs the agent to generate an index.html file and run ffmpeg commands on the local system.
Sanitization: The build brief lacks specific instructions to escape or sanitize user-provided strings before inserting them into the HTML/JavaScript code, potentially allowing for script injection in the rendering context.
[DYNAMIC_EXECUTION]: The skill provides a detailed prompt for generating a functional HTML and JavaScript application (index.html) used for frame-exact video rendering.
[COMMAND_EXECUTION]: The skill suggests running ffmpeg commands to extract frames from video clips provided by the user, using template paths like clips/<command>/%06d.jpg.

toolkit-video