The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses local media processing tools through shell scripts like prep-footage.sh and mouths.sh, which invoke ffmpeg and ffprobe to join video takes and generate comparison grids. Additionally, render.mjs executes other project scripts using execFileSync to manage asset workflows.\n- [DATA_EXFILTRATION]: Local audio and video files are transmitted to external APIs (HeyGen and ElevenLabs) for avatar training, voice synthesis, and transcription. While these actions are central to the skill's functionality, they constitute a data exfiltration surface for sensitive personal media assets.\n- [EXTERNAL_DOWNLOADS]: The skill downloads generated video files from HeyGen's storage using presigned URLs provided by the API at runtime.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied text in voice.mjs to generate audio assets.\n
Ingestion points: User text input is accepted via command line arguments for the voice.mjs script.\n
Boundary markers: No boundary markers or warnings against embedded instructions are implemented for the input text.\n
Capability inventory: The skill possesses network access (fetch), file write capabilities (fs.writeFileSync), and subprocess execution (execFileSync).\n
Sanitization: The skill does not perform sanitization or filtering on the user-provided text before sending it to external APIs.\n- [DYNAMIC_EXECUTION]: Local dynamic execution occurs in render.mjs, which programmatically invokes upload.mjs using execFileSync to handle asset management during the video generation process.\n- [SAFE]: The skill follows secure credential management practices by loading API keys from environment variables or local .env files instead of hardcoding them in the scripts.

create-ai-avatar