The Agent Skills Directory

[COMMAND_EXECUTION]: The instructions in references/finishing.md describe using FFmpeg locally to assemble ads, such as padding, overlaying logos, and drawing text. The skill specifically includes a security warning to prevent command injection by using text files for copy (drawtext=textfile=…) instead of splicing arbitrary strings directly into shell commands.
[INDIRECT_PROMPT_INJECTION]: The skill processes user-provided inputs like copy, headlines, and brand references to generate media assets, creating an attack surface for instructions embedded in that data.
Ingestion points: User creative files, brand briefs, and ad copy (headlines, CTAs) ingested via SKILL.md and references/brand-reference.md.
Boundary markers: The instructions recommend using specific layout layers and copy regions to isolate text, and advise using dedicated text files for tool inputs to maintain separation between data and execution logic.
Capability inventory: The skill utilizes image/video generation tools, local FFmpeg execution, and network API communication with the Magic Hour backend.
Sanitization: references/finishing.md explicitly warns against splicing untrusted copy into shell commands or filter expressions, directing the agent to use safer rendering methods.
[EXTERNAL_DOWNLOADS]: The skill connects to a Model Context Protocol (MCP) server at https://mcp.magichour.ai/ and references an OpenAPI definition at https://docs.magichour.ai/api-reference/openapi.json to perform its intended functions. These resources are hosted on the vendor's own official infrastructure.

magic-hour-campaign-kit