The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides instructions for utilizing standard command-line tools for video processing, rendering, and environment setup.
Evidence includes shell commands for npx, ffmpeg, brew, and playwright found in SKILL.md and references/product-demo-recording.md.
The skill promotes secure execution patterns, such as using spawnSync with array arguments to mitigate command injection risks.
[EXTERNAL_DOWNLOADS]: The skill leverages the npm registry via npx to initialize programmatic video frameworks and install browser dependencies.
Specifically mentions hyperframes, create-video, and playwright packages.
[INDIRECT_PROMPT_INJECTION]: The skill includes functionality for reverse-engineering video edits by ingesting external data such as transcripts and on-screen text from social media platforms.
The skill identifies this as a potential attack surface and includes mandatory instructions in references/edit-anatomy.md to treat fetched content as untrusted and to never follow instructions embedded within it.
[CREDENTIALS_UNSAFE]: A hardcoded API key placeholder (sk_live_123abc) is present in evals/evals.json.
This exists solely as a test case for security evaluation to ensure the agent correctly refuses to handle secrets pasted into chat. The skill explicitly warns against this practice in references/product-demo-recording.md and recommends the use of environment variables or secret managers.

video