The Agent Skills Directory

[PROMPT_INJECTION]: The skill is subject to Indirect Prompt Injection (Category 8) because it ingests untrusted data from external websites to drive creative decisions. The agent is instructed to read extracted site text and descriptions to understand brand voice and product strategy, which could be manipulated by hidden instructions on a target website to influence the generated script or video content.
Ingestion points: The agent reads captured content from capture/extracted/visible-text.txt and capture/extracted/asset-descriptions.md in Steps 2 and 3.
Boundary markers: No explicit delimiters or instructions are provided to the agent to ignore potential commands embedded within the captured website text.
Capability inventory: The skill executes shell commands via npx hyperframes and generates executable HTML/JavaScript files (compositions/*.html).
Sanitization: The instructions do not specify sanitization or filtering of the ingested website text before it is used to generate the storyboard and script.
[COMMAND_EXECUTION]: The skill's workflow depends on the execution of the npx hyperframes CLI tool across multiple steps (capture, update, lint, snapshot, render). These commands are used to manage the project lifecycle and execute the video rendering engine. The tool is a recognized vendor resource for 'heygen-com'.
[EXTERNAL_DOWNLOADS]: The skill performs network operations to capture website data and interacts with remote APIs for AI services.
Evidence: references/step-0-capture.md uses npx hyperframes capture <URL> to download site assets.
Evidence: references/step-4-vo.md uses curl to interact with ElevenLabs and HeyGen APIs for text-to-speech generation. These are well-known services and consistent with the skill's purpose.
[DATA_EXFILTRATION]: The skill manages sensitive API keys (Gemini, ElevenLabs, HeyGen). While the instructions guide the user to store these in .env files (standard safe practice), the agent is also told to 'just use it and move on' if a user provides a key directly in chat. There is no evidence of malicious exfiltration of these keys to third-party domains.

website-to-video