The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection through user-supplied research data. Ingestion points: The skill collects 'facts' and 'source links' from the user in Step 1 to be displayed on screen. Boundary markers: The skill includes a negative constraint in Step 4 ('Add nothing I did not give you'), but lacks formal delimiters for the untrusted data. Capability inventory: The skill generates an index.html file and relies on an external rendering tool (hyperframes) to process the generated code. Sanitization: There is no evidence of sanitization, escaping, or validation of the user-provided facts before they are interpolated into the HTML code.
[EXTERNAL_DOWNLOADS]: The skill recommends installing the hyperframes tool from the heygen-com organization via npx. This is documented neutrally as it involves fetching a tool from a known video generation service provider to facilitate the skill's primary purpose.
[COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands to install and run the rendering tool, specifically using 'npx skills add' and 'npx hyperframes render'.
[DYNAMIC_EXECUTION]: The skill generates a self-contained index.html file that uses a window.seek function to render specific frames based on time. This dynamic generation of executable code is used to create the video sequence from templates.

vox-explainer