The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts/record.mjs and scripts/post.mjs scripts use node:child_process.spawnSync to execute ffmpeg and ffprobe for video processing and metadata extraction. Additionally, scripts/record.mjs includes an optional capability to execute shell commands defined within the reset block of a demo script, which is restricted by a mandatory --allow-commands flag.
[DYNAMIC_EXECUTION]: The skill performs dynamic loading of the playwright-core dependency in scripts/record.mjs using dynamic import(). It also executes JavaScript in the browser context via Playwright's page.evaluate and context.addInitScript to handle UI overlays, clock synchronization, and state resets.
[EXTERNAL_DOWNLOADS]: The skill relies on several external tools and libraries, including playwright-core, ffmpeg, and ffprobe. It also references external drivers such as agent-browser and agent-desktop from Vercel Labs for specific recording scenarios.
[INDIRECT_PROMPT_INJECTION]: The skill processes user-provided or project-specific .demo.json files to drive automation.
Ingestion points: scripts/record.mjs reads and parses JSON demo scripts to execute actions.
Boundary markers: The skill does not use explicit prompt delimiters but relies on the scripts/demo-check.mjs utility to validate script safety.
Capability inventory: Capabilities include arbitrary shell command execution (gated), browser automation (allowing file and network access), and video file generation.
Sanitization: The demo-check.mjs gate provides comprehensive sanitization by scanning scripts for secrets (API keys, card numbers, private tokens), real email addresses, and brittle selectors before execution.

khe-demo