The Agent Skills Directory

[COMMAND_EXECUTION]: The skill requires local terminal access to perform its primary functions. It executes numerous shell commands via provided scripts (preflight.sh, analyze_ref.sh, preview.mjs) to check system state, analyze video frames, and manage environment variables. It also instructs the agent to install dependencies using npm, pip, and npx (e.g., npm i three gsap, pip install demucs).
[EXTERNAL_DOWNLOADS]: The skill fetches a wide variety of external resources necessary for motion graphics production. This includes Node.js and Python packages from official registries (NPM/PyPI), browser binaries via npx playwright install chromium, AI model weights for video matting and transcription (RVM, SAM2), and media assets from well-known services like Pixabay, Pexels, Freesound, and ElevenLabs. These downloads target established technology providers and are handled via documented APIs.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a significant attack surface for indirect prompt injection. It is designed to process untrusted external data, specifically by using the Playwright MCP to browse and download assets from arbitrary websites (Pinterest, Behance, Dribbble) and by analyzing user-provided reference video files. Malicious instructions could be embedded in the content of these websites or within the metadata of processed files, potentially influencing the agent's behavior during the production workflow.
[DATA_EXPOSURE]: The skill interacts with .env files to manage sensitive API keys for external services. It implements robust security practices by providing scripts (create_env.sh, normalize_env.py) that automatically add these files to .gitignore to prevent accidental commits. Furthermore, the instructions explicitly command the agent never to print, log, or echo API key values in the chat or project logs.

motion-video-director