The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes data from external sources, such as product JSON metadata via scraping and embedded images in SVG files. This allows untrusted external content to enter the agent's context.
Ingestion points: Product data is scraped from user-provided URLs using curl. Logo images are extracted from SVG files.
Boundary markers: No delimiters or specific instructions to ignore embedded commands are present in the processing logic.
Capability inventory: The skill can execute shell commands (ffmpeg, curl), write/generate scripts, and interact with external AI providers.
Sanitization: There is no evidence of sanitization or validation of the scraped JSON or SVG content before processing.
[DYNAMIC_EXECUTION]: The skill instructions require the agent to generate and adapt Python scripts (e.g., for logo extraction and video assembly) based on provided snippets and reference descriptions, rather than using static, pre-defined scripts.
[DATA_EXFILTRATION]: The pipeline involves reading sensitive configuration data, specifically the FAL_API_KEY, from a .env file located at gtm-goose/.env to authenticate with external services.
[COMMAND_EXECUTION]: The skill performs multiple shell operations including asset downloading with curl, JSON parsing with jq, and complex video processing with ffmpeg.
[EXTERNAL_DOWNLOADS]: The skill downloads a static font asset from a public GitHub repository during the brand asset gathering phase.

render-hypermotion