The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill downloads color LUTs from https://static.heygen.ai and various audio assets (BGM, SFX, TTS) via the HeyGen API at https://api.heygen.com. It also triggers the installation of several well-known Python packages (such as transformers, torch, and google-genai) to support local media generation tasks.
[COMMAND_EXECUTION]: The skill makes extensive use of spawn, spawnSync, and execFileSync to interface with system tools like ffmpeg and ffprobe, as well as Python-based ML runners. The implementation consistently uses literal argument arrays rather than shell strings, which effectively mitigates command injection risks.
[DYNAMIC_EXECUTION]: In audio/scripts/lib/bgm.mjs, the skill dynamically constructs a Python script from a template to execute MusicGen operations via python -c. This is a localized use of dynamic code generation for a primary feature and does not ingest arbitrary remote code for execution.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data, including HTML composition files (in scripts/audio-duck.mjs) and JSON transcripts (in scripts/transcript-cut.mjs).
Ingestion points: Reads project-local HTML files (--composition) and JSON transcript files (--transcript).
Boundary markers: Instructions in SKILL.md emphasize that the agent should perform grounded scans and never silently mutate color or media without user confirmation.
Capability inventory: Includes file writing (writeFileSync), network requests (fetch), and command execution (spawn).
Sanitization: Includes regex escaping (escapeRegExp) when parsing HTML attributes and uses safe execution patterns for subprocesses.

media-use