The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill generates video content by rendering HTML templates that incorporate data from external release notes or changelogs. In scripts/compose_demo.py, fields like title and body are inserted directly into HTML templates without sanitization to support formatting tags. This creates a risk where malicious code embedded in the release documentation could execute in the Playwright headless browser context.
Ingestion points: The spec.json file, which is populated with data from external release milestones or changelogs, is used to generate HTML frames in scripts/compose_demo.py.
Boundary markers: None identified; external data is interpolated directly into template strings.
Capability inventory: The skill uses playwright for rendering and JavaScript execution, subprocess for ffmpeg operations (file system access), and curl for network requests to external APIs.
Sanitization: Lacking; only the address field is escaped using html.escape, while other text fields remain unsanitized.
[COMMAND_EXECUTION]: The skill makes extensive use of ffmpeg for video rendering, audio mixing, and frame extraction. Multiple scripts including render.py, compose_demo.py, mix_sfx.py, mix_final.sh, and frames_from_video.sh execute these operations via subprocess calls or shell scripts to process media files on the local system.
[EXTERNAL_DOWNLOADS]: The skill performs network requests using curl to interact with the ElevenLabs API (api.elevenlabs.io) for sound and music generation as defined in scripts/gen_audio.sh. ElevenLabs is a well-known service for AI-generated audio.

release-video