The Agent Skills Directory

Indirect Prompt Injection Surface: The skill features modules designed to ingest and process data from external sources, including news articles, tweets, and live webpages. If this untrusted content is incorporated into generated video compositions without rigorous sanitization, it could potentially influence the agent's behavior or the integrity of the rendered output.\n
Evidence: Found in categories/webpage/module.md, categories/news/module.md, and categories/tweet/module.md.\n- Command Execution: The workflow frequently utilizes npx to run the hyperframes utility and its associated sub-commands for project initialization, skill updates, and asset management. Additionally, it invokes ffmpeg and ffprobe for media manipulation tasks.\n
Evidence: SKILL.md and grounding/locate.mjs contain various npx and ffmpeg calls.\n- Dynamic Execution (Headless Browser): The bake-basemap.mjs utility uses Puppeteer to render map imagery. The browser is launched with the --no-sandbox argument. While this is often necessary in certain restricted environments (like Docker or specific CI setups), it increases the security risk if the browser processes untrusted remote content.\n
Evidence: Located in categories/maps/bake-basemap.mjs.\n- External Resource Ingestion: The skill fetches geographical data, map tiles, and library scripts from established third-party services such as Esri, Carto, and JSDelivr. These resources are utilized to provide the core mapping and visualization capabilities of the skill.\n
Evidence: References to external URLs are present in categories/maps/bake-basemap.mjs.

motion-graphics