The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute several shell commands, including the higgsfield CLI for image generation, a Python script for rendering HTML with Playwright, and ffmpeg for video scaling and QC frame extraction.
[EXTERNAL_DOWNLOADS]: The skill makes network requests to external domains, including fetching brand wordmark images from user-supplied or sourced CDN URLs (e.g., touchland.com) and loading fonts from Google Fonts (fonts.googleapis.com). These are standard operations for the skill's purpose but involve external resource retrieval.
[INDIRECT_PROMPT_INJECTION]: The skill has a vulnerability surface for indirect prompt injection.
Ingestion points: User-provided Headline copy and Micro-labels are ingested from the input brief.
Boundary markers: None are present; strings are inserted directly into the HTML source.
Capability inventory: The resulting HTML is processed by a headless browser (Playwright) and then converted to video via ffmpeg. Maliciously crafted headline text (e.g., containing <script> or other HTML tags) could execute in the browser context during the render phase.
Sanitization: There is no evidence of sanitization, escaping, or validation of the user-provided strings before they are written to endcard.html.

create-end-card-from-reference