The Agent Skills Directory

[COMMAND_EXECUTION]: The skill includes a Node.js export script (film-capture.mjs) and shell instructions that execute external binaries, specifically Google Chrome/Chromium and ffmpeg, to capture frames and encode the final MP4 video.
[DYNAMIC_EXECUTION]: The automation script utilizes the Chrome DevTools Protocol (Runtime.evaluate) to execute JavaScript within the headless browser context. This is used to drive the film's internal clock for frame-by-frame rendering and to extract synthesized audio data from the browser's memory.
[INDIRECT_PROMPT_INJECTION]: The workflow involves processing external URLs and media files provided by the user as creative references. This represents an attack surface where a malicious site or media file could potentially target vulnerabilities in the browser or media processing tools.
Ingestion points: Reference URLs (YouTube, X, Vimeo) and local video files provided by the user for style matching.
Boundary markers: The skill recommends the agent seek user confirmation and provide screenshots of external references rather than directly downloading unknown content, acting as a functional human-in-the-loop check.
Capability inventory: The skill can execute shell commands, spawn browser processes, and write files to the local disk via the provided export script.
Sanitization: Standard browser and ffmpeg security models are relied upon; no additional input sanitization is implemented for the reference URLs.
[SAFE]: The skill's operations are idiomatic for its stated purpose as a video export tool. It uses built-in Node.js modules and documented system capabilities without obfuscation or unauthorized data access.

product-film