The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes external binaries including Node.js, FFmpeg, and a web browser to perform video rendering and visual snapshots. These calls use list-based arguments without a shell, and the tool paths are verified against a project-local environment lock file (.html-video/environment.json) to prevent execution of unverified binaries.\n- [EXTERNAL_DOWNLOADS]: The bootstrap command installs the hyperframes package from the public NPM registry at a pinned version (0.8.147). It also facilitates the download of a browser engine (Chrome or chrome-headless-shell) using the pinned CLI's native installation mechanism. These operations are restricted to the initial project setup phase and targeting official repositories.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes user-authored HTML, CSS, and JavaScript as input for video compositions. This presents an attack surface where malicious code could be embedded in source files to execute during browser-based snapshots. The skill mitigates this through a mandatory audit step that blocks remote resource loading, detects unseekable animations, and warns about recognizable script hazards like runtime network APIs or wall-clock timers.\n- [SAFE]: The skill implements an extensive "offline-first" security policy. It includes deterministic checks for path escapes, symlink traversal, and remote resource inclusion in hv_audit.py, ensuring that the rendering process is reproducible and isolated from unauthorized network access when following the provided workflow.

html-video