The Agent Skills Directory

[PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection via unsanitized data interpolation.
Ingestion points: User-provided briefs and product details specified in SKILL.md are used to populate graphic templates.
Boundary markers: The HTML templates in assets/templates/ utilize %%VARIABLE%% style placeholders (e.g., %%PRODUCT_NAME%%, %%TAGLINE_PRIMARY%%) to delimit dynamic content.
Capability inventory: The scripts/render_hyperframe.py script utilizes Playwright to render these templates. This browser environment has the capability to execute JavaScript and potentially access the local filesystem via the file:// protocol.
Sanitization: There is no evidence of HTML escaping or sanitization of input strings before they are injected into the templates, creating a risk if malicious scripts are provided in the input brief.
[EXTERNAL_DOWNLOADS]: The skill depends on external resources from well-known and reputable services.
The HTML templates in assets/templates/ load the GSAP animation library from cdnjs.cloudflare.com and typography assets from fonts.googleapis.com.
Setup instructions in references/gotchas.md recommend installing standard third-party libraries such as playwright and pillow from the Python Package Index.
[COMMAND_EXECUTION]: Local shell command invocation is used for media processing.
The script scripts/render_hyperframe.py executes the ffmpeg binary using subprocess.run. The command is constructed using a list of arguments, which prevents standard shell injection vulnerabilities, and is used for the intended purpose of encoding PNG frames into an MP4 video.

create-motion-graphics-hyperframes