The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses several system-level tools to process media. The scripts scripts/finish.sh, scripts/face-lock.sh, and scripts/review-sheet.sh invoke ffmpeg and ffprobe for image manipulation and metadata extraction. Additionally, it launches google-chrome in headless mode to convert HTML layouts into images.
[DYNAMIC_EXECUTION]: In scripts/finish.sh, the skill dynamically generates an HTML file that references local images and fonts. This file is then rendered by a headless browser to produce the final thumbnail. The generation process includes security controls such as regular expression validation for colors and font names, and a Content Security Policy (CSP) that restricts script execution to a specific, hashed script.
[EXTERNAL_DOWNLOADS]: The rendering process fetches stylesheets and font files from fonts.googleapis.com and fonts.gstatic.com. These are well-known and trusted services used for web-based asset delivery.
[INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied briefs and descriptions to generate AI image prompts and thumbnail text. While this exposes a potential injection surface, the skill mitigates risk by applying html.escape to user text before rendering and by isolating the rendering process using a restricted browser profile and CSP.

youtube-thumbnails