The Agent Skills Directory

Indirect Prompt Injection Surface: The capture command allows the agent to scaffold projects directly from live URLs, which involves ingesting untrusted web content.
Evidence:
Ingestion points: npx hyperframes capture <URL> in SKILL.md and references/init-and-scaffold.md.
Boundary markers: There are no explicit instructions to use delimiters or ignore instructions within the captured content.
Capability inventory: The skill possesses capabilities for local command execution (npx hyperframes), file system modification (init, capture), and network operations for cloud rendering.
Sanitization: The instructions recommend visual verification through snapshots and previews, but do not specify automated sanitization of captured HTML/JS content.
Command Execution: The skill relies heavily on the npx hyperframes CLI to perform a wide range of tasks, including environment diagnosis, project scaffolding, and rendering.
Evidence: Various commands like npx hyperframes check, npx hyperframes render, and npx hyperframes doctor are used throughout the documentation to manage the video development lifecycle.
External Resource Access: The skill performs remote operations to maintain its environment, including downloading a pinned Chromium build and checking for skill updates on GitHub.
Evidence:
npx hyperframes browser ensure downloads a specific Chrome version for rendering consistency (references/doctor-browser.md).
The init command checks AI coding skills against GitHub repositories (references/init-and-scaffold.md).
Cloud Credential Interaction: To support distributed and cloud-based rendering, the skill interacts with standard local credential files.
Evidence:
Access to ~/.aws/credentials for AWS Lambda deployment (references/lambda.md).
Access to ~/.heygen/credentials for HeyGen cloud rendering (references/cloud.md).

hyperframes-cli