The Agent Skills Directory

[COMMAND_EXECUTION]: The skill makes extensive use of system commands to perform its tasks:
Orchestrates video processing using npx remotion (ffprobe, ffmpeg, render, still).
Installs system and language dependencies using brew install whisper-cpp and pip install Pillow.
Generates and executes a Python script at runtime (Step 4) to perform image manipulation (grid overlays) using the Pillow library.
Generates React/TypeScript files (Root.tsx, Composition.tsx) that are compiled and executed during the rendering process.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection due to its processing of untrusted data:
Ingestion points: Processes external audio content by transcribing it into a JSON transcript (/tmp/transcript) in Step 2.
Boundary markers: No specific delimiters or instructions are provided to the agent to ignore potentially malicious commands embedded in the transcribed narration.
Capability inventory: The agent has the ability to write files (Composition.tsx), execute shell commands (npx remotion render), and perform network operations.
Sanitization: The skill lacks sanitization or validation logic for the transcript content before using it to influence code generation and keyframe logic. An attacker could embed instructions in the video's audio to manipulate the agent's behavior during the 'Read the transcript' phase.
[EXTERNAL_DOWNLOADS]: The skill fetches external resources from well-known and trusted sources:
Downloads a Whisper model file (ggml-base.en.bin) from Hugging Face's official repository via curl.
Uses npx create-video to bootstrap the project framework from the npm registry.
These downloads are from established providers and do not present an inherent risk in this context.

video-polish