The Agent Skills Directory

[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface. It ingests untrusted data from external URLs or user-provided scripts (stored in capture/extracted/visible-text.txt) and uses this content as context for the agent to design storyboards and video scripts. There are no explicit boundary markers or instructions to the agent to ignore embedded commands within this processed data, which could allow maliciously crafted web pages to influence the agent's behavior during the planning phase.
Ingestion points: Data enters the agent's context through capture/extracted/visible-text.txt and capture/extracted/asset-descriptions.md, which are generated by crawling external URLs provided by the user.
Boundary markers: Absent; the agent is instructed to read these files directly to extract product facts and positioning.
Capability inventory: The skill can execute various shell commands via npx (capture, render, init), write files to the workspace, and dispatch sub-agents for frame generation.
Sanitization: While some sanitization exists for HTML attributes in scripts/assemble-index.mjs, there is no sanitization of the natural language content used to interpolate prompts for storyboard generation.
[COMMAND_EXECUTION]: The skill frequently executes shell commands using npx to interact with the hyperframes CLI tool and various local Node.js scripts. These commands are used for project initialization, asset capture, authentication status checks, and final video rendering. While these tools are associated with the vendor, the broad use of command execution is a notable capability.
[DYNAMIC_EXECUTION]: The workflow involves the dynamic generation of HTML and JavaScript files (index.html and frame-specific .html files) at runtime. These files utilize the GSAP library (loaded from a public CDN) to define animation timelines. This generated code is then processed by a rendering engine to produce the final video file. This multi-step process where code is constructed and then executed is typical for programmatic video generation but increases the complexity of the execution environment.

product-launch-video