The Agent Skills Directory

[PROMPT_INJECTION]: The skill is designed to ingest and process data from external URLs, GitHub repositories, and user-provided documents to generate video prompts, creating a surface for indirect prompt injection. 1. Ingestion points: Content is extracted from external links, product sites, and GitHub repos as specified in 'references/source-extraction.md'. 2. Boundary markers: The skill lacks explicit instructions for the agent to use delimiters or ignore embedded instructions when interpolating untrusted data. 3. Capability inventory: The skill produces shell commands for other tools and includes its own maintenance scripts that the agent is encouraged to run. 4. Sanitization: There is no evidence of filtering or validation for the content extracted from external sources.
[REMOTE_CODE_EXECUTION]: The skill's installation instructions promote the use of 'npx' to execute code directly from the vendor's GitHub repository. Additionally, the 'SKILL.md' file instructs the agent to run 'scripts/check-update.mjs' during the session. These actions occur within the vendor's own ecosystem.
[EXTERNAL_DOWNLOADS]: The 'scripts/check-update.mjs' file performs network requests to 'raw.githubusercontent.com' to fetch version information. This is a standard version check targeting the vendor's official repository.
[COMMAND_EXECUTION]: The installer script 'scripts/install.mjs' utilizes 'execSync' to perform system operations such as 'git clone'. The skill also generates 'node' command templates for the user to execute other HiAPI rendering skills.

hiapi-video-prompt-generator