The Agent Skills Directory

[COMMAND_EXECUTION]: The skill includes several scripts (gpu_policy.py, work_guard.py, browser_gpu_probe.cjs, clip-audit.js) that interact with the host system using subprocess or playwright. These scripts execute commands like ffmpeg, ffprobe, nvidia-smi, and manage browser-based rendering audits. While these are necessary for verifying hardware acceleration and ensuring render quality, they represent a significant command execution surface.
[EXTERNAL_DOWNLOADS]: The SKILL.md and references/hyperframes-playbook.md files recommend the installation of the 'HyperFrames' production infrastructure using npx skills add heygen-com/hyperframes. This introduces a dependency on external code from a third-party repository.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process various external inputs, creating a vulnerability surface for indirect prompt injection.
Ingestion points: User-provided creative briefs, scripts, video references for reverse-engineering (Phase 2), and data sources like CSV files for data-driven animation.
Boundary markers: The instructions lack specific guidance on using delimiters or warnings to prevent the agent from following instructions embedded in these external assets.
Capability inventory: The skill has access to powerful tools, including shell command execution (ffmpeg), browser automation (playwright), and the ability to trigger other specialist skills in the pack.
Sanitization: There is no evidence of sanitization or filtering for content extracted from video metadata, scripts, or data files before they are incorporated into the agent's context.

motion-director