The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection by ingesting untrusted external data. Ingestion points: The calculateMetadata function in rules/calculate-metadata.md fetches data from a user-defined props.dataUrl. Additionally, rules/display-captions.md and rules/import-srt-captions.md fetch and parse external caption files. Boundary markers: Absent. There are no instructions or delimiters provided to ensure the agent ignores potentially malicious instructions embedded within the fetched JSON or SRT data. Capability inventory: The skill has the ability to execute shell commands via bunx (rules/ffmpeg.md), perform network requests, and write to the file system (rules/transcribe-captions.md). Sanitization: Absent. Data fetched from remote URLs is processed and used to drive rendering or props without explicit validation or sanitization of the content.
[COMMAND_EXECUTION]: The skill uses shell commands for media manipulation and environment management. Evidence: rules/ffmpeg.md uses bunx remotion ffmpeg and bunx remotion ffprobe for video processing tasks such as trimming and metadata inspection. Evidence: Multiple files (rules/3d.md, rules/audio.md, etc.) recommend using npx remotion add or similar package manager commands to install project dependencies.
[EXTERNAL_DOWNLOADS]: The skill facilitates downloading assets and data from various external sources. Evidence: rules/voiceover.md fetches AI-generated audio from ElevenLabs (api.elevenlabs.io). Evidence: rules/lottie.md downloads animation data from LottieFiles (assets4.lottiefiles.com). Evidence: rules/transcribe-captions.md utilizes the @remotion/install-whisper-cpp package to download the Whisper.cpp binary and associated models. Evidence: rules/sfx.md references sound effect files hosted on a public GitHub repository (github.com/kapishdima/soundcn).

remotion-best-practices