The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes screen titles, descriptions, and asset metadata from the Stitch design platform, which are used to construct video components and manifests. This creates a potential surface for instructions embedded in design files to influence the agent's behavior.
Ingestion points: Metadata and image assets are retrieved via Stitch MCP tools and written to local files like screens.json for video composition.
Boundary markers: The skill includes comprehensive validation checklists (validation-checklist.md, composition-checklist.md) and instructions to mark unverified data explicitly, which helps prevent the accidental execution of malicious content.
Capability inventory: The skill utilizes curl for asset downloads and Remotion CLI tools (npm, npx) for video rendering.
Sanitization: The download-stitch-asset.sh script uses atomic file operations and strictly enforces HTTPS protocols to ensure asset integrity.
[EXTERNAL_DOWNLOADS]: Fetches design screenshots and assets from Google Cloud Storage (storage.googleapis.com), which is an established and well-known service.
[COMMAND_EXECUTION]: Utilizes local shell scripts (scripts/download-stitch-asset.sh) and Node.js package tools (npm, npx) to manage assets and execute the Remotion rendering pipeline.
[DYNAMIC_EXECUTION]: Assembles React code templates (WalkthroughComposition.tsx, ScreenSlide.tsx) and JSON manifests at runtime to define the structure and timing of the video composition. These are standard operations for the skill's primary purpose.
[CREDENTIALS_SAFE]: The instructions and scripts include explicit protections against logging or persisting sensitive data such as signed URLs, session cookies, or tokens extracted during the asset retrieval process.

stitch-remotion