The Agent Skills Directory

[DYNAMIC_EXECUTION]: The script scripts/package-loader.mjs implements a custom mechanism to download and load Node.js dependencies at runtime. It uses npm install to fetch packages into a temporary directory and subsequently relaunches the Node.js process using spawnSync to include the new package location.
[EXTERNAL_DOWNLOADS]: The skill initiates external downloads from the NPM registry during dependency bootstrapping in package-loader.mjs. Additionally, the text-to-speech functionality described in references/tts.md triggers the download of Kokoro-82M model files (approximately 311 MB) upon first use.
[COMMAND_EXECUTION]: The instructions direct the agent to execute various shell commands, such as npx hyperframes for validation and rendering, and starting a local HTTP server using python3 -m http.server for the design picker tool.
[DATA_EXFILTRATION]: The transcription guide in references/transcript-guide.md documents the process of sending local audio and video files to external transcription services like OpenAI and Groq via curl commands, which involves transmitting local media data to remote servers.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted input from user prompts and transcription data to generate video compositions. Malicious instructions embedded in these inputs could potentially influence the behavior of the headless browser during the automated inspection and validation phases.
Ingestion points: The skill reads external data from transcript.json and design.md files created during the workflow.
Boundary markers: The skill uses JSON structures to delimit some data, but many interpolations into the final HTML composition lack strict boundary protection.
Capability inventory: The skill utilizes automated inspection tools (hyperframes inspect) that execute generated HTML/JS in a headless browser context.
Sanitization: Basic word-level filtering for transcripts is described, but full sanitization of injected content is not enforced.

hyperframes