The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from GitHub Pull Requests, including titles, descriptions, and comments, which are used to generate the video's storyboard and script. While basic cleaning is performed, malicious PR content could attempt to influence the agent's narrative or visual choices.\n
Ingestion points: PR metadata and body are processed in scripts/ingest.mjs and stored in capture/extracted/visible-text.txt.\n
Boundary markers: The skill uses structured formats for STORYBOARD.md and SCRIPT.md to scope the impact of ingested text.\n
Capability inventory: The skill can execute shell commands (gh, ffmpeg, npx), perform network requests, and write to the local filesystem.\n
Sanitization: scripts/ingest.mjs strips HTML comments and enforces character limits on the PR body.\n- [COMMAND_EXECUTION]: The skill invokes several command-line tools to fulfill its primary purpose. It uses gh to retrieve Pull Request details and diffs, ffmpeg and ffprobe to handle audio manipulation, and npx for various HyperFrames framework operations. These executions are consistent with the skill's stated functionality and use safe argument arrays.\n- [EXTERNAL_DOWNLOADS]: The skill performs several network-based operations to fetch necessary assets. It downloads contributor avatars from GitHub's official domains and retrieves animation blocks from the HyperFrames registry via the CLI. It also loads the GSAP library from a well-known CDN. These downloads target trusted organizations and well-known services.

pr-to-video