The Agent Skills Directory

[COMMAND_EXECUTION]: The skill orchestrates several command-line utilities, including ffmpeg, ffprobe, vhs, and ttyd, using Bun.spawn and Bun.spawnSync to handle video encoding and verification. These commands are invoked using array arguments, which helps prevent shell injection vulnerabilities by ensuring that arguments are not treated as shell commands.
[EXTERNAL_DOWNLOADS]: The audio.md reference provides guidance on fetching royalty-free music and sound effects from services like Pixabay and Mixkit using curl. These operations target established, well-known media providers for asset acquisition.
[DYNAMIC_EXECUTION]: The skill uses the Chrome DevTools Protocol (CDP) to evaluate JavaScript at runtime within a headless browser instance (Runtime.evaluate). This mechanism is necessary for the skill's primary function of seeking specific timeframes in a browser-based scene. Additionally, the skill includes instructions for bundling the three.js library locally using Bun.build for WebGL rendering.
[INDIRECT_PROMPT_INJECTION]: The skill ingests data from local project files to drive the rendering process.
Ingestion points: The workflow reads .motion/brief.md, .motion/beats.md, and .motion/facts.md to determine animation parameters, timing, and text content.
Boundary markers: The instructions specify that the agent should use "facts from files only" and "Example data" labels, but the skill does not implement formal integrity checks or delimiters to prevent instruction injection within these data sources.
Capability inventory: The skill has the ability to execute shell commands via ffmpeg, launch a browser with Bun.spawn, and perform network operations.
Sanitization: Data from these project files is treated as parameters (numeric values or text strings) for deterministic rendering logic and is not passed to a shell or used as executable code instructions in the rendering scripts.

motion-render