The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes system commands to process media and manage its environment. scripts/extract-audio-data.py invokes the ffmpeg utility to extract frequency bands from audio or video files, and scripts/package-loader.mjs uses npm to facilitate the installation of necessary helper packages.
[UNVERIFIABLE_DEPENDENCIES_AND_REMOTE_CODE_EXECUTION]: The skill fetches external resources from well-known technology services. scripts/package-loader.mjs downloads Node.js dependencies (such as @hyperframes/producer and sharp) from the official NPM registry, and templates/design-picker.html loads the GSAP animation library from the jsDelivr CDN and typography from Google Fonts.
[DYNAMIC_EXECUTION]: A custom loading script (scripts/package-loader.mjs) manages its own dependencies by creating a temporary environment and re-executing itself when required packages are missing.
[INDIRECT_PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface as it processes user-provided HTML compositions and design templates.
Ingestion points: scripts/contrast-report.mjs reads content from a composition directory, and templates/design-picker.html renders user-defined preview_html tokens.
Boundary markers: Not present in the processing logic, but the skill's documentation provides clear warnings against executable content.
Capability inventory: contrast-report.mjs performs DOM evaluation via Puppeteer, and the design picker uses innerHTML for rendering.
Sanitization: references/design-picker.md instructs the agent to ensure that injected HTML does not contain <script> tags or event handlers, mitigating the risk of cross-site scripting in the local tool environment.

hyperframes-creative