The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes data from external X (Twitter) profiles which is considered untrusted input.
Ingestion points: Profile data (name, bio, followers, etc.) is gathered from x.com and api.fxtwitter.com as described in SKILL.md and references/profile-data.md.
Boundary markers: The skill instructions do not explicitly define boundary markers for the agent prompts, but the processing script enforces strict formatting.
Capability inventory: The skill has the capability to write files to the local file system and execute shell commands (npx hyperframes) via the agent.
Sanitization: The scripts/build.mjs file provides robust sanitization, including stripping control characters, validating counter values as integers, and performing HTML escaping on all substituted strings to prevent template injection.
[EXTERNAL_DOWNLOADS]: The skill depends on several external resources for its functionality.
The hyperframes CLI tool is fetched from the npm registry via npx during the render step.
The GSAP animation library is loaded from the cdn.jsdelivr.net content delivery network at preview/render time.
Profile avatar images are downloaded from Twitter's image CDN (pbs.twimg.com).
[COMMAND_EXECUTION]: The skill requires the execution of shell commands to generate and render the video.
The agent is instructed to run node scripts/build.mjs to prepare the project files.
The agent executes npx hyperframes render to perform the video rendering process, which involves a headless browser and GPU resources.

x-posting-license