The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses ffmpeg and ffprobe for local media processing, such as extracting frames from video and rendering the final MP4. Commands are executed via execFileSync and spawn using argument arrays, which prevents shell-injection vulnerabilities.
[DYNAMIC_EXECUTION]: It dynamically loads rendering logic from a local visuals.mjs file using import(). This is a core architectural feature that allows for customizable canvas-based graphics while keeping the main script execution scope controlled.
[EXTERNAL_DOWNLOADS]: The skill downloads generated video assets from Fal AI's infrastructure (queue.fal.run). The implementation includes protocol validation to ensure that all remote downloads occur over secure HTTPS connections.
[INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied text for video generation and speech synthesis.
Ingestion points: User-provided plan.json fields for scene text and headings.
Boundary markers: Uses <d> tags within the model prompt templates to isolate user-supplied spoken lines.
Capability inventory: Media processing (ffmpeg), local file system access for run state, and network calls to specific AI providers.
Sanitization: The validatePlan function rejects spoken text containing < or > characters, preventing users from breaking out of the prompt's data tags.

talking-head