The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill instructions facilitate the ingestion of untrusted external data which could contain malicious instructions for the AI agent.
Ingestion points: The calculateMetadata function (rules/calculate-metadata.md) fetches data from arbitrary URLs provided in props. Lottie animation data (rules/lottie.md) and captions JSON files (rules/display-captions.md) are also loaded from remote sources. Additionally, extractFrames (rules/extract-frames.md) and media metadata utilities process video and audio files from URLs.
Boundary markers: No specific delimiters or "ignore instructions" warnings are included in the provided code snippets to protect against data-embedded instructions.
Capability inventory: The skill includes capabilities to write files to the local filesystem using fs.writeFileSync (rules/transcribe-captions.md), perform network requests via fetch, and execute rendering commands via npx.
Sanitization: There is no evidence of schema validation, sanitization, or escaping of the fetched JSON content before it is processed by the React components.
[EXTERNAL_DOWNLOADS]: The skill requires the installation of numerous external dependencies and fetches assets from various remote domains.
Dependencies: Installs third-party packages such as mapbox-gl, @turf/turf, zod, and mediabunny.
Assets: Fetches Lottie files from lottiefiles.com and media assets from remotion.media.
Tools: The transcription rule (rules/transcribe-captions.md) involves downloading and installing the whisper.cpp binary and associated models.
[COMMAND_EXECUTION]: The skill documentation describes the use of shell-based tools for video rendering and transcription.
Render commands: Instructions include executing npx remotion render with specific flags for GPU acceleration and concurrency (rules/maps.md).
FFmpeg: The transcription guide includes a commented-out reference to using execSync to run FFmpeg commands for audio conversion.

remotion-best-practices