The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill provides instructions to install various dependencies using package managers (npm, yarn, pnpm, bun). These include official Remotion packages (e.g., @remotion/media, @remotion/three, @remotion/captions, @remotion/transitions) and established libraries like zod and mapbox-gl. It also provides examples of fetching media assets and JSON data from remote URLs such as remotion.media and lottiefiles.com. All identified sources are official or well-known services.
[INDIRECT_PROMPT_INJECTION]: The skill documentation includes patterns for fetching and processing untrusted data from external sources, which constitutes an indirect prompt injection attack surface.
Ingestion points: Files rules/calculate-metadata.md, rules/import-srt-captions.md, and rules/lottie.md contain code snippets for fetching external resources like API data, .srt subtitle files, and Lottie JSON assets.
Boundary markers: The code examples do not specify the use of boundary markers or instructions to the agent to treat fetched data as untrusted content.
Capability inventory: The skill demonstrates usage of external data for UI rendering and animation metadata. While no direct shell execution based on this data is present, the data influences the agent's context during development tasks.
Sanitization: There is no explicit sanitization or validation shown for the content of the fetched assets in the provided examples.
Remediation: It is recommended to validate and sanitize any external data before processing it within the agent's execution context or rendering logic.

remotion-best-practices