The Agent Skills Directory

[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by autonomously scraping brand assets and marketing copy from external sources such as Shopify and the Meta Ad Library. This untrusted content is used to populate prompts for video (Kling), music (ElevenLabs), and image generation.\n
Ingestion points: brand_url (Shopify CDN), Meta Ad Library copy.\n
Boundary markers: None explicitly implemented in the prompt construction logic.\n
Capability inventory: Shell command execution via FFmpeg and Playwright, file system writes, and network operations.\n
Sanitization: No visible sanitization or validation of the scraped text before prompt interpolation.\n- [COMMAND_EXECUTION]: The production workflow involves executing multiple subprocesses and shell commands, including FFmpeg for video stitching and muxing, and Playwright for frame-by-frame kinetic typography rendering via JS renderAt(t) patterns.\n- [EXTERNAL_DOWNLOADS]: The skill downloads stock footage and brand assets from well-known technology platforms. It specifically uses the curl_cffi library for browser impersonation to ensure successful retrieval of assets from the Pexels CDN, which is documented as a bypass for Cloudflare protections.\n- [NO_CODE]: Key implementation scripts listed in scripts/README.md, such as pexels_download.py, kling_v3_pro.py, and build_master.py, are not included in the provided fileset. This prevents a complete security evaluation of the code's internal logic and system interactions.

create-hybrid-ad