The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The project includes a build-time tool (scripts/build_masthead_outlines.py) that downloads and installs Python packages from PyPI. This tool utilizes a hash-pinned lock file (requirements-masthead.lock) and the --require-hashes flag to ensure the integrity of the downloaded artifacts. This process is used solely for generating vector glyph geometry and is not part of the installed runtime.
[COMMAND_EXECUTION]: Multiple validation and test scripts utilize subprocess.run() to execute internal checks and build utilities. These include:
scripts/validate_repo.py and scripts/schema_check.py for repository health and JSON schema enforcement.
scripts/build_hero.py and scripts/build_masthead_outlines.py for generating SVG assets.
scripts/extract_last_frame.py which interfaces with FFmpeg to extract frames from video files.
Testing suites that perform automated verification of the skill's logic.
[DATA_EXFILTRATION]: The developer utility scripts/eval_run.py is designed to send prompts to external Large Language Model providers (Anthropic and Minimax) for automated evaluation. It retrieves API keys from environment variables (ANTHROPIC_API_KEY, MINIMAX_API_KEY). This tool is explicitly documented as development-only in SECURITY.md and is excluded from the installed payload via scripts/install_codex_skill.py. The destinations are well-known API endpoints for model providers.
[SAFE]: The repository contains its own security linter (tests/test_install_payload.py) that AST-parses every Python file in a simulated installation to ensure no network modules are imported and no credential-shaped literals are present, ensuring the installed skill remains offline by design.

seedance-20