The Agent Skills Directory

[COMMAND_EXECUTION]: The skill dynamically generates a Node.js script (analyse-reel.js) and saves it to the user's desktop before instructing the agent to execute it. This runtime code generation and execution poses a security risk if the logic is manipulated or if untrusted input is incorporated into the script.
[EXTERNAL_DOWNLOADS]: The skill uses the Apify client to download video files (.mp4) and metadata from Instagram to a local directory (~/Desktop/Reels/downloads/). While targeting well-known services, downloading external binary content to the local filesystem requires caution.
[PROMPT_INJECTION]: The skill processes untrusted data from external Notion links and Instagram transcripts. This content is interpolated into a prompt for Gemini 2.5 Flash, creating a surface for indirect prompt injection attacks where malicious instructions hidden in the Reel or Notion page could influence the agent's behavior.
[CREDENTIALS_UNSAFE]: The instructions require the user to provide and export sensitive environment variables (APIFY_API_TOKEN and GOOGLE_AI_API_KEY). While necessary for the skill's functionality, handling secrets in shell environments can lead to accidental exposure in command history.

reels-scripting