The Agent Skills Directory

[COMMAND_EXECUTION]: The skill makes extensive use of system binaries to perform image and video processing tasks. Specifically, grounding/locate.mjs and categories/maps/bake-basemap.mjs execute ffmpeg and ffprobe to draw on images, probe media metadata, and encode frame sequences into MP4 files. Additionally, bake-basemap.mjs launches a headless browser using puppeteer-core to render map tiles and capture screenshots.
[EXTERNAL_DOWNLOADS]: The skill fetches several external resources during the asset sourcing and map baking phases. It downloads JavaScript libraries including maplibre-gl, topojson-client, and gsap from the JSDelivr CDN, which is a well-known service. It also fetches geographic data from world-atlas on JSDelivr and retrieves map tiles from established providers like Esri and CARTO. The grounding/locate.mjs script optionally calls the Google Gemini API for object detection if an API key is provided.
[PRIVILEGE_ESCALATION]: The categories/maps/bake-basemap.mjs script launches Puppeteer with the --no-sandbox flag enabled. While often required for execution within containerized or CI environments, this disables a primary layer of browser security and increases the risk if the browser processes malicious content.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection as it is designed to ingest and process untrusted external data from the web.
Ingestion points: The webpage and news categories utilize tools to capture content from URLs provided by the user or found via search, including DOM structures and article text.
Boundary markers: The documentation in categories/webpage/module.md instructs the agent to check for security challenge pages or block reports (BLOCKED.md) and requires user confirmation before proceeding with animation of captured content.
Capability inventory: The skill has the ability to execute shell commands via ffmpeg and puppeteer, and can perform file system writes to save project artifacts.
Sanitization: SKILL.md specifies that Figma-sourced assets undergo SVG sanitization and provenance tracking before being used in the pipeline.

motion-graphics