The Agent Skills Directory

[UNVERIFIABLE_DEPENDENCIES_AND_REMOTE_CODE_EXECUTION]: The skill instructions specify using npx to download and initialize the hyperframes project and to add related skills. The scripts/seam-gate.mjs script also programmatically spawns npx to run a pinned version of the vendor's hyperframes package (0.8.14) from the npm registry. These operations involve downloading and executing code from external repositories provided by the skill author.
[DYNAMIC_EXECUTION]: The skill involves local code generation and evaluation during the build process. The scripts/seam-stamp.mjs script generates GSAP animation logic and injects it into the project's index.html file. Furthermore, scripts/seam-gate.mjs uses the Chrome DevTools Protocol to evaluate a measurement harness inside a local browser instance.
[INDIRECT_PROMPT_INJECTION]: The skill ingests user-supplied documents and URLs to extract story beats, which presents a surface for indirect prompt injection. The skill mitigates this by instructing the agent to verify claims independently and requiring user approval of the beat map before proceeding.
[DATA_EXPOSURE_AND_EXFILTRATION]: The skill fetches media assets from public-domain archives such as Wikimedia Commons and the Library of Congress. It also mentions the potential use of TTS and transcription APIs, but it explicitly requires the agent to obtain user consent, detailing the provider and data shared, before making network requests to these services.

vox-explainer