The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes external processes to perform prerequisite checks and video encoding.
Evidence: The scripts/check.mjs and scripts/render.mjs files use node:child_process (spawnSync) to call ffmpeg. The commands are constructed using argument arrays, which is a secure practice that prevents shell injection.
[EXTERNAL_DOWNLOADS]: The skill requires several external dependencies and provides instructions for their installation from trusted sources.
Evidence: The scripts/check.mjs script prompts the user to install the playwright npm package and the Chromium browser (npx playwright install chromium). It also suggests installing FFmpeg via official system package managers such as Homebrew, APT, or Winget.
[INDIRECT_PROMPT_INJECTION]: The skill's workflow involves generating HTML content based on user-provided text briefs, which is then executed in a headless browser.
Ingestion points: User prompts are used to determine the content and structure of the animation.html file.
Boundary markers: There are no specific delimiters used when the agent generates the HTML from the user's brief.
Capability inventory: The skill writes files to the local disk, spawns FFmpeg processes, and executes JavaScript within a Playwright browser instance.
Sanitization: No explicit sanitization of user-provided text is performed before it is included in the generated HTML; however, the execution environment (headless browser) and the local nature of the tool limit the risk.
[PRIVILEGE_ESCALATION]: The setup process may involve commands that require elevated permissions.
Evidence: For Linux users, the scripts/check.mjs script suggests the command sudo apt install ffmpeg to install a necessary dependency, which is a standard procedure for system-level package installation.

html-video