The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses child_process.execSync and execFileSync within record-master.template.js to execute ffmpeg commands for video scaling, frame rate adjustment, and audio muxing.
[REMOTE_CODE_EXECUTION]: The skill employs dynamic execution techniques to manage complex video assembly. In record-master.template.js, it dynamically constructs a JavaScript driver script that is injected into HTML and executed within a Playwright browser session. Additionally, stitch.template.sh uses a Python heredoc to compute audio offsets and filter arguments, which are then evaluated and executed by the shell.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted input in the form of a sender_roster which is directly rendered into the notification avalanche animation.
Ingestion points: The sender_roster names are ingested from production/sender-roster.json and utilized in the record-master.template.js recording logic.
Boundary markers: There are no visible boundary markers or escaping mechanisms for the sender names before they are interpolated into the JavaScript driver script.
Capability inventory: The skill possesses capabilities to execute arbitrary shell commands via ffmpeg, run JavaScript in a browser via Playwright, and execute Python scripts.
Sanitization: The template code does not demonstrate explicit sanitization or validation of the sender names, creating a potential surface for cross-site scripting (XSS) within the Playwright recording environment if a malicious roster is provided.

notification-flood-ad