The Agent Skills Directory

[PROMPT_INJECTION]: Surface for indirect prompt injection identified in data fetching patterns.
Ingestion points: The calculateMetadata function in rules/calculate-metadata.md fetches data from a caller-controlled props.dataUrl. Similarly, rules/lottie.md and rules/import-srt-captions.md demonstrate fetching remote assets.
Boundary markers: The skill does not provide delimiters or instructions to ignore embedded commands when processing the content of these external files.
Capability inventory: The skill examples focus on media rendering and metadata calculation, which do not demonstrate high-risk system-level access, but the processed data can still be used to influence the agent's behavior.
Sanitization: There is no evidence of data validation or sanitization before the fetched JSON or text data is integrated into the application state.
[EXTERNAL_DOWNLOADS]: The skill instructs the user to install several Node.js dependencies from the @remotion scope and the mediabunny library.
These installations are performed using standard package manager commands (via remotion add) and target known libraries within the ecosystem.
[SAFE]: The skill references official documentation on the remotion.dev domain for legitimate configuration instructions, which is a safe and common practice.

remotion-best-practices