The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill generates HTML files (index.html, captions.html) that include the GSAP animation library from jsdelivr.net, which is a well-known and trusted content delivery network.
Evidence: scripts/assemble-index.mjs and scripts/captions.mjs both contain script tags linking to https://cdn.jsdelivr.net/npm/gsap@3.14.2/dist/gsap.min.js.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection as it ingests external website content and user-provided scripts to generate video instructions and code.
Ingestion points: External URLs are captured via npx hyperframes capture and user input is saved to user_script.txt as described in SKILL.md Step 1.
Boundary markers: The workflow incorporates manual user approval gates at Step 0 (Setup), Step 3 (Storyboard/Script approval), and Step 6 (Final Render) to mitigate unintended behavior.
Capability inventory: The skill performs extensive file writing within the project directory and executes several shell commands via the npx hyperframes CLI (render, check, lint, snapshot) as outlined in SKILL.md and various scripts.
Sanitization: The scripts/assemble-index.mjs utility includes escapeHtmlAttr and specific attribute filtering logic to sanitize properties when hoisting video elements from sub-compositions to the main index file.

product-launch-video