The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted script text from a configuration file and renders it into a browser context, creating an attack surface for local code execution within the rendering session.
Ingestion points: User-provided paragraph text and CTA copy are loaded from note.json into record-master.template.js.
Boundary markers: Absent; user-provided data is interpolated directly into driver scripts and HTML templates without delimiters or "ignore" instructions.
Capability inventory: The skill has access to subprocess execution (FFmpeg, node, python3), file system writes, and full browser control through Playwright.
Sanitization: Partial sanitization is applied to ampersands and quotes in tagTypedParagraphs, but the applyUnderline function in the driver script subsequently renders text using innerHTML, allowing for arbitrary HTML injection.
[DYNAMIC_EXECUTION]: The skill uses require() with a computed path in record-master.template.js to dynamically load a generator script from a related 'atom' skill. It also generates and injects a driver JavaScript payload into the recording template at runtime.
[COMMAND_EXECUTION]: Uses execSync and subprocess.run to execute ffmpeg, ffprobe, node, and python3 for media processing and automation. These operations are essential for the skill's primary purpose of ad generation.
[SAFE]: External audio assets are sourced from BigSoundBank, which is a well-known service for high-quality, CC0-licensed sound effects. The skill provides instructions for manual sourcing rather than performing automated downloads.

create-apple-notes-video-ad