The Agent Skills Directory

[COMMAND_EXECUTION]: The orchestration script scripts/render.py executes system-level commands to run helper scripts and external tools like ffmpeg and node. It utilizes subprocess.run with list-based arguments to manage the rendering pipeline, which allows the skill to perform complex tasks by delegating to specialized local processes.
[INDIRECT_PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface (Category 8) as it relies on external data to drive its core logic:
Ingestion points: Configuration data is loaded from a JSON file in scripts/build_html.py and scripts/render.py via json.loads.
Boundary markers: The skill does not employ explicit delimiters or system instructions to ignore potentially malicious commands or scripts embedded within user-provided text fields like hook, caption, or tagline.
Capability inventory: The skill can read local files (specified in the config), write to temporary directories, execute local scripts via subprocess, and control a headless Chromium browser using playwright-core.
Sanitization: Although json.dumps is used to safely pass some values into the HTML's JavaScript context, other configuration strings are interpolated directly into the HTML DOM structure. This could permit the injection of HTML or scripts that execute within the local headless Chromium rendering environment.

render-search-grid