The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill is designed to manage and use API keys for the OpenRouter service. It attempts to locate credentials in several locations, including environment variables, specific configuration files (~/.config/openrouter/key), and operating system keychains (macOS Keychain via security and Linux secret-tool). The implementation follows security best practices by providing a redaction mechanism to prevent keys from appearing in logs or terminal output, and instructions advise against storing keys in shared environment variables.
[COMMAND_EXECUTION]: Several components of the skill execute shell commands. The verify_mp4.py and openrouter_media.py scripts invoke ffmpeg and ffprobe for media verification and transformation. Additionally, the skill utilizes npx to manage the HyperFrames framework and its dependencies. These operations are core to the skill's functionality but represent a standard command execution surface.
[EXTERNAL_DOWNLOADS]: The skill fetches external resources, including font files from the JSDelivr CDN and media assets (audio, images, and video) generated via the OpenRouter API. These downloads target well-known and established service providers.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data, such as text extracted from websites via the hyperframes capture command and user-provided documents. This content is used to generate video scripts, narration, and animation code, creating a potential vector for indirect prompt injection if the source data contains malicious instructions. While secret redaction is implemented, explicit content sanitization for the model's input is not described.
[DYNAMIC_EXECUTION]: The SKILL.md file contains instructions to execute dynamic Node.js code using the -e flag to parse design tokens and color roles from local project files. This allows the agent to programmatically interact with the design system during the build process.

intro-video