The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill references and utilizes resources from external repositories and package registries.
References the website-to-hyperframes skill from the official HeyGen-associated GitHub repository as a mandatory dependency.
Installs the openai-whisper package via pip for local audio transcription.
Loads the gsap animation library and Google Fonts via public CDNs for the generated HTML composition.
Utilizes npx to fetch and run the hyperframes CLI tool for project initialization and video rendering.
[COMMAND_EXECUTION]: The skill requires the execution of various CLI tools and network-capable commands to perform its core functions.
curl is used to send narration scripts to the ElevenLabs API for text-to-speech generation.
sips and ffprobe are invoked locally to extract pixel dimensions and audio duration metadata.
whisper is executed locally to generate word-level timestamps from audio files.
npx hyperframes commands are used to manage the video rendering lifecycle.
[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface due to the handling of external repository data.
Ingestion points: The skill fetches untrusted GitHub repository metadata, including descriptions and README content, via web-search or fetch_url (SKILL.md Step 0).
Boundary markers: There are no delimiters or protective instructions used when interpolating this untrusted data into the narration script or the final HTML composition.
Capability inventory: The skill possesses capabilities including network requests (curl), local file processing (sips, ffprobe), and code rendering/execution via npx hyperframes and browser-based compositions.
Sanitization: Repository metadata is directly inserted into Step 1 (narration script) and Step 4 (HTML/JS template) without sanitization, which could allow maliciously crafted repository descriptions to influence the AI's narration or the behavior of the rendered HTML composition.

github-repo-tour