The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The script scripts/prepare_deps.py downloads animation libraries (GSAP) and font packages from the npm registry. While this involves downloading and extracting external code, it targets a well-known service and the script implements security measures such as regex validation for package names to prevent command injection and tarball extraction filters to mitigate path traversal risks.
[COMMAND_EXECUTION]: The skill makes extensive use of the subprocess module to orchestrate video rendering and asset processing. It calls external utilities including ffmpeg for video encoding, npm for dependency fetching, and poppler-utils for PDF manipulation. These operations are strictly limited to the skill's primary purpose and use safe argument passing.
[INDIRECT_PROMPT_INJECTION]: The skill operates by ingesting and analyzing untrusted external content such as PDF reports and slide decks. This creates a surface for indirect prompt injection where malicious instructions inside a processed document could attempt to influence the agent's behavior during the content extraction or storyboard phases. The skill includes HTML escaping in its runtime core as a partial mitigation.
[DYNAMIC_EXECUTION]: The animation engine dynamically assembles a project consisting of HTML, CSS, and JavaScript based on user data. This project is executed within a headless Chromium instance to generate the final video frames. This runtime generation is the intended core functionality of the motion graphics system.
[EXTERNAL_DOWNLOADS]: The skill references and fetches assets from well-known services including the npm registry and Google Fonts to create self-contained, offline-ready presentation files.

motion-apresentacao