The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill downloads the Montserrat font from the official Google Fonts GitHub repository during the setup phase in preflight.sh.
[EXTERNAL_DOWNLOADS]: The setup script installs agent-browser (a tool from Vercel Labs) and awaz (an ElevenLabs TTS utility) via the Node Package Manager (NPM).
[COMMAND_EXECUTION]: The skill uses ddev exec to run automation commands inside a web container, including xdotool for simulating mouse and keyboard input and ffmpeg for video processing. These are standard operations for the skill's stated purpose of creating narrated screencasts.
[CREDENTIALS_UNSAFE]: The skill requires an ELEVENLABS_API_KEY for narration. It correctly instructs the user to manage this sensitive information manually via environment variables or local configuration files rather than hardcoding it or attempting to automate its extraction.
[OBFUSCATION]: The hands.sh script uses Base64 decoding (type64) to handle input text. This is explicitly documented as a functional requirement to ensure that special characters (like those in regex or code snippets) are not mangled by the ddev exec shell boundary, rather than an attempt to hide malicious activity.
[INDIRECT_PROMPT_INJECTION]: The skill reads local Drupal module files (README, .info.yml) to generate a storyboard. While this represents an ingestion point for potentially untrusted data, the risk is mitigated by the requirement that the agent must present the storyboard to the user for approval before proceeding with recording or execution.

drupal-tutorial-video