The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill uses npx degit diffusionstudio/lottie to download a Lottie player project template and npm install to fetch project dependencies. These operations involve downloading and installing third-party code from an external repository not included in the trusted vendors list.
[COMMAND_EXECUTION]: Several shell commands are used for workflow management, including npm run dev to start the local Vite server and curl to interact with the local context endpoint at http://localhost:<port>/__context for project discovery.
[DYNAMIC_EXECUTION]: The skill instructs the agent to run node -e with a script that uses fs.readFileSync and JSON.parse to validate the contents of the generated lottie.json file. This represents a dynamic execution surface within the validation workflow.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted user input to generate Lottie JSON and reads existing JSON files from the filesystem to modify them. The workflow lacks explicit boundary markers or sanitization instructions for these data ingestion points, creating a potential surface for indirect prompt injection, particularly as the processed data is later used in command templates.

text-to-lottie