The Agent Skills Directory

[COMMAND_EXECUTION]: The skill frequently executes system commands via Node.js and Python, calling external binaries like ffmpeg, ffprobe, git, and npx for media processing and version management.\n- [DATA_EXFILTRATION]: Optional cloud functionality sends user-generated video segments and text to ByteDance Volcengine and TTS endpoints. While documented and requiring user consent, this involves transmitting user content to remote servers.\n- [EXTERNAL_DOWNLOADS]: The skill fetches stock imagery from the official Wikimedia Commons API and retrieves repository metadata from GitHub.\n- [PERSISTENCE]: The initialization process for the recommended animation backend (npx hyperframes init) installs 19 additional skill files into the user's local environment (~/.claude/skills/).\n- [TIME_DELAYED_CONDITIONAL]: The skill contains logic directing the agent to execute shell commands (git) to check for updates every 30 days based on a local timestamp file.\n- [INDIRECT_PROMPT_INJECTION]: The skill has a large vulnerability surface as it is designed to ingest and process data from untrusted external URLs and third-party codebases while possessing significant system capabilities.\n- [OTHER]: Cloud interaction scripts (fetch_images.py and ai-review-video.py) explicitly disable system proxy environment variables to bypass local connection errors, which overrides existing network security and monitoring configurations.

huashu-design