The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The init command automatically checks for and updates the agent's own instruction sets (skills) from GitHub. The skill documentation notes that the flag to skip this update check is currently disabled, forcing an automated remote update of the agent's capabilities during initialization.\n- [DATA_EXFILTRATION]: The telemetry system fingerprints the agent's execution environment by checking for environment variables that identify specific AI platforms (such as Claude, Devin, or Cursor). Additionally, the tool provides a --remote-debugging-port flag that exposes a Chromium CDP endpoint, which could allow external access to the browser instance if misconfigured.\n- [INDIRECT_PROMPT_INJECTION]: The capture command scaffolds projects by downloading content from external URLs. This untrusted content is subsequently processed and executed in a headless browser during the validate step. \n
Ingestion points: references/init-and-scaffold.md (the capture command ingests live URLs).\n
Boundary markers: Absent.\n
Capability inventory: SKILL.md (file writing, network operations, shell command execution via FFmpeg/AWS, and script execution in Chrome).\n
Sanitization: Not mentioned.\n- [COMMAND_EXECUTION]: The skill requires significant shell interaction, executing commands for rendering, AWS Lambda deployment via SAM, and environment diagnostics using npx, ffmpeg, and aws-cli.\n- [EXTERNAL_DOWNLOADS]: The tool downloads external browser binaries (Chrome), AI models for transcription, and agent instructions from GitHub and npm registries during setup and maintenance.\n- [DYNAMIC_EXECUTION]: The validate and inspect commands execute project-linked JavaScript and motion assertions within a headless browser environment to audit layout and animation timing.

hyperframes-cli