The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill's cloud initialization script (cloud/cloud-init.sh) downloads and executes environment setup scripts from well-known services and trusted organizations, including NodeSource (Node.js setup), Astral (uv installer), and Anthropic (Claude installer). These are used to prepare the temporary cloud instance for video production.
[COMMAND_EXECUTION]: The skill makes extensive use of local shell commands via Node.js execFileSync and spawn to orchestrate its pipeline. This includes running ffmpeg and ffprobe for media processing, git for repository management, and uv for Python-based rendering tools. These operations are restricted to the local environment and the temporary cloud instances created by the skill.
[DYNAMIC_EXECUTION]: Several scripts utilize dynamic execution for internal logic:
cloud/mb.mjs uses the new Function constructor to evaluate JavaScript selectors against JSON data returned by the Vultr API. The expressions are hardcoded within the skill's shell scripts.
scripts/smoke.mjs uses the Node.js vm module to run the animation engine and chapter-specific code within a sandbox to detect runtime errors and missing assets without rendering actual pixels.
[INDIRECT_PROMPT_INJECTION]: The skill presents an indirect prompt injection surface as it ingests book titles and chapter content from the VoiceDrop platform to drive an automated animation pipeline involving sub-agents. While the workflow is highly structured and includes some sanitization (e.g., in scripts/split_chapters.mjs), the reliance on sub-agents to generate code (chNN.js) based on book content introduces a standard risk for this category.
[CREDENTIALS_SAFE]: The skill manages sensitive API keys (Vultr, Volcano ASR, Claude OAuth) by reading them from local environment files (.env, secrets.env) or the execution environment. There are no hardcoded secrets or unsafe exfiltration patterns detected; network operations to the vendor's domain (jianshuo.dev) are used for legitimate project deployment.

wjs-voicedrop-creating-motion-book