The Agent Skills Directory

[COMMAND_EXECUTION]: The skill orchestrates a complex workflow by executing several local scripts and system tools, including Node.js (gen-registry.mjs, render-all.mjs, qa-frames.mjs), Python (bake.py, scan_flicker.py, gen_image.py), and ffmpeg for video processing.
[INDIRECT_PROMPT_INJECTION]: The skill processes external, user-provided project files that act as an attack surface for indirect prompt injection.
Ingestion points: The agent reads videos/video-N/work/edit-plan.md, v2-update-plan.md, and timeline.json as the "source of truth" for the project.
Boundary markers: No delimiters or safety instructions are used to distinguish project data from potentially malicious embedded instructions.
Capability inventory: The agent can write executable code to the file system and perform arbitrary shell command execution via the pipeline scripts.
Sanitization: No sanitization or validation of the input plan content is performed before the agent acts on the instructions.
[DYNAMIC_EXECUTION]: The agent generates and edits .tsx (Remotion) files in the remotion/src/shots/ directory based on the logic described in the project plan. These files are subsequently executed by the Remotion engine during rendering. An attacker could potentially inject malicious logic into the project plan that the agent then translates into executable code on the host machine.
[DATA_EXFILTRATION]: The skill instructions involve accessing sensitive file paths to create realistic developer-oriented video mockups.
Evidence: Review Rule 13 explicitly directs the agent to use git show <hash>:.env to retrieve and display content in the video UI.
Risk: Accessing actual .env files poses a data exposure risk. If the project contains real secrets, they may be rendered into the final video preview. While Rule 23 suggests using fake formats for illustrative strings, Rule 21 mandates using "real evidence files" for logs and paths, creating a conflict that may result in the exposure of real credentials.

make-tsx