The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The scripts/capture.sh script attempts to install the agent-browser package from the NPM registry at runtime if it is missing from the system. Additionally, scripts/poll.sh uses the urllib library in Python to download media files from remote URLs provided by the generation service.
[COMMAND_EXECUTION]: The skill relies on several shell scripts (batch.sh, capture.sh, poll.sh) that execute external CLI tools such as cohub, npm, and agent-browser. It also uses python3 to handle JSON data and system operations within these bash scripts.
[INDIRECT_PROMPT_INJECTION]: The pipeline includes a mechanism to capture screenshots of live web pages via capture.sh. This introduces a surface where malicious instructions embedded in a website's content could be ingested by the agent during the film-making process.
Ingestion points: The capture.sh script takes arbitrary URLs as input; poll.sh retrieves task results and download URLs from an external API.
Boundary markers: There are no explicit delimiters or instructions provided to the agent to disregard instructions found within the captured web content or downloaded metadata.
Capability inventory: The skill possesses the capability to execute shell commands, perform network downloads, automate a web browser, and write various files (PNGs, JSON, Markdown) to the local filesystem.
Sanitization: The scripts do not perform sanitization or filtering on the data retrieved from external sources before it is saved and potentially processed by the agent.

film-pipeline