The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill relies on npx to download and execute the hyperframes CLI tool from the npm registry for transcription and video rendering tasks.- [COMMAND_EXECUTION]: The skill uses several system utilities including ffmpeg, ffprobe, mkdir, and sed. The suggested shell commands in SKILL.md use variables like $VIDEO_PATH inside double quotes or command substitutions without adequate escaping, which could lead to command injection if a video file name contains shell metacharacters.- [PROMPT_INJECTION]: The skill workflow is susceptible to indirect prompt injection by ingesting and acting upon an untrusted ASR transcript generated from the input video audio. The agent is instructed to read, edit, and use this transcript to design graphic cards without verification of its content.
[INDIRECT_PROMPT_INJECTION_EVIDENCE]:
Ingestion points: transcript.json (SKILL.md Step 4 and 5).
Boundary markers: Absent; no delimiters or security warnings are used for the transcript data.
Capability inventory: ffmpeg, npx, mkdir, cp, sed.
Sanitization: Absent; no validation or filtering is applied to the transcript text.

graphic-overlays