The Agent Skills Directory

[DYNAMIC_EXECUTION]: The script scripts/shoot.mjs uses page.evaluate() to execute arbitrary JavaScript strings provided in the input configuration. While intended for UI manipulation (e.g., expanding details tags) during receipt capture, it allows for code execution within the browser context.
[COMMAND_EXECUTION]: scripts/pty_capture.py spawns a Windows pseudo-terminal (winpty) to execute shell commands specified in a script JSON. This is designed to capture real terminal output but could be misused to execute unauthorized commands if the input script is manipulated.
[COMMAND_EXECUTION]: Several scripts (master_audio.py, review_sheets.py, thumbnail.py, clean_stills.py, shoot.mjs) execute system commands via subprocess.run or spawnSync. Specifically, they call ffmpeg for media processing and npx hyperframes for rendering tasks.
[INDIRECT_PROMPT_INJECTION]: Phase 1 of the skill involves researching news and stories from the live web. This creates a significant surface area for indirect prompt injection, where malicious instructions hidden in news articles or websites could attempt to override the agent's behavior during lyric writing or visual planning.
[EXTERNAL_DOWNLOADS]: The skill fetches brand logos and speaker recognition models from external services:
scripts/fetch_logos.py downloads SVG assets from cdn.jsdelivr.net (Simple Icons and LobeHub).
scripts/voice_cast.py downloads pre-trained speaker embedding models from Hugging Face.
These are sourced from well-known or trusted providers but involve fetching external binary/data assets at runtime.

agent-music-video