The Agent Skills Directory

[Indirect Prompt Injection Surface]: The skill ingests and processes external video transcripts to generate thumbnail concepts and summaries. This presents a potential surface where malicious instructions embedded within the transcript data could attempt to influence the agent's behavior. \n
Ingestion points: Video transcripts processed via the transcribe_audio tool as described in the working loop in SKILL.md.\n
Boundary markers: The instructions do not define specific delimiters or "ignore embedded instructions" warnings for the transcript data interpolation.\n
Capability inventory: The skill possesses the ability to execute shell commands via node for image processing, perform file writes, and use the upload_files tool for delivery.\n
Sanitization: No explicit sanitization or validation of the ingested transcript content is performed before it is used for concept generation.\n- [Dynamic Library Loading]: The scripts small-size-gate.mjs and thumb-gate.mjs utilize dynamic loading to resolve the sharp image processing library. This is achieved using createRequire with a path derived from the DESIGN_AGENT_RENDER_DIR environment variable. Although this is a functional requirement for the skill's image analysis tasks, it involves dynamic loading from computed paths.\n- [Functional Command Execution]: The skill's instructions guide the agent to execute several internal Node.js scripts and command-line tools (such as html2png.mjs, thumb-gate.mjs, and hyperframes) to generate, analyze, and validate thumbnail files. These operations are performed on files within the project workspace.\n- [Path Confinement]: As a security-positive pattern, the provided Node.js scripts include a confine function that validates all file paths against the designated /workspace directory. This practice effectively restricts file operations to the intended environment and mitigates potential path traversal risks.

thumbnails