The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses ffmpeg and ffprobe in its CLI tools (tools/render.mjs, tools/join.mjs) to process and export video files. These commands are executed with structured argument arrays, preventing command injection vulnerabilities.
[EXTERNAL_DOWNLOADS]: The 3D rendering example (examples/films/3d-render-泡芙工作室/film.html) loads the Three.js library from cdn.jsdelivr.net, which is a well-known and trusted Content Delivery Network. This is a functional requirement for 3D graphics support.
[DYNAMIC_EXECUTION]: The framework uses dynamic JavaScript import() in starter/film.html and starter/lib/reel.js to load animation scripts (film.js or user-defined modules). This behavior is necessary for the skill's primary purpose of executing AI-generated or user-provided MG animation code.
[DATA_EXPOSURE_AND_EXFILTRATION]: The skill includes local server components (starter/lib/server.mjs, examples/lib/server.mjs) that listen only on the 127.0.0.1 loopback address, ensuring they are not exposed to the external network. No unauthorized access to sensitive files or exfiltration of data was observed.
[OBFUSCATION]: The project uses Base64 encoding in its tools (tools/render.mjs, tools/check.mjs) exclusively for transferring binary image (DataURL) and audio (PCM) data between the browser context and the Node.js environment during the video export process. This is a standard functional use case and not a malicious concealment technique.

shiwu-huajing