The Agent Skills Directory

[COMMAND_EXECUTION]: Multiple documentation files instruct the agent or user to execute npx remotion add <package> to install required dependencies. This is a standard operation within the Remotion ecosystem but involves shell command execution.
Evidence found in: references/3d.md, references/audio.md, references/display-captions.md, references/fonts.md, references/measuring-text.md, references/videos.md, and references/transitions.md.
[EXTERNAL_DOWNLOADS]: The skill encourages downloading various external assets including Google Fonts, Lottie JSON files, and remote media files (video/audio). It also utilizes several official @remotion/* packages and the mediabunny utility library.
Evidence found in: references/assets.md, references/fonts.md, references/lottie.md, and references/import-srt-captions.md.
[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection attack surface. Several files provide code examples that fetch and process external data from user-controllable URLs (e.g., metadata from a URL, Lottie animation files, SRT subtitles). This untrusted data is then parsed and used to drive the video rendering process without explicit sanitization or boundary markers.
Ingestion points: references/calculate-metadata.md (props.dataUrl), references/import-srt-captions.md (SRT fetch), references/lottie.md (Lottie JSON fetch).
Boundary markers: Absent in provided examples.
Capability inventory: Network requests via fetch(), shell execution via npx.
Sanitization: No input validation or sanitization is demonstrated for the fetched content.

remotion