The Agent Skills Directory

[PROMPT_INJECTION]: The skill instructions create a surface for indirect prompt injection by fetching and processing external data files from untrusted or user-defined URLs.
Ingestion points: The calculateMetadata function fetches data from props.dataUrl, and components in display-captions.md and import-srt-captions.md fetch JSON and SRT files via fetch() and staticFile().
Boundary markers: The instructions lack explicit boundary markers or warnings to the agent to ignore potentially malicious instructions embedded in these external data sources.
Capability inventory: The skill has access to powerful tools including shell command execution (npx, npm, ffmpeg) and file system operations.
Sanitization: There is no mention of sanitizing or validating the content of fetched data before it is processed or used to drive agent behavior.
[EXTERNAL_DOWNLOADS]: The skill instructs the agent to use the @remotion/install-whisper-cpp package to download and install the Whisper.cpp binary and associated models. While this is a common workflow for this library, it involves the retrieval and setup of external executable code at runtime.
[COMMAND_EXECUTION]: The skill makes extensive use of command-line tools to manage the development lifecycle. This includes project scaffolding with npx create-video, dependency management with npm, yarn, pnpm, and bun, and media processing with ffmpeg and ffprobe.

remotion