The Agent Skills Directory

[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by instructing the agent to fetch and process data from external URLs and local files to determine video composition properties and content. 1. Ingestion points: Untrusted data enters the agent context via fetch calls for video metadata in SKILL.md, dynamic props in rules/calculate-metadata.md, captions in rules/display-captions.md and rules/import-srt-captions.md, Lottie animations in rules/lottie.md, and documentation in rules/tailwind.md. 2. Boundary markers: The instructions do not define delimiters or warnings to ignore embedded instructions in the fetched data. 3. Capability inventory: The skill utilizes shell commands through the Remotion CLI and performs network requests via fetch. 4. Sanitization: The provided examples lack data validation or sanitization steps before the external content is used to drive composition logic.
[REMOTE_CODE_EXECUTION]: The skill documents the use of @remotion/install-whisper-cpp to download, install, and execute the Whisper.cpp binary for audio transcription in rules/transcribe-captions.md. While this involves downloading and running external code, it is a standard and official feature of the Remotion framework used for speech-to-text functionality.
[EXTERNAL_DOWNLOADS]: The documentation in rules/sfx.md recommends a third-party GitHub repository (github.com/kapishdima/soundcn) as a source for additional sound effects, directing the user to unverified external content.

remotion-best-practices