The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill instructs the agent to "write and render" a silent video (e.g., mp4) using slides created from repository data. This necessitates the runtime generation of scripts or the use of media libraries to synthesize video content, which constitutes dynamic code generation and execution.
[COMMAND_EXECUTION]: Rendering media files typically requires the invocation of external command-line tools (such as ffmpeg or ImageMagick). The instruction to render video "outside the repo" explicitly grants the agent permission to perform file-write operations and execute system-level commands to process media.
[INDIRECT_PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it processes untrusted data sources to generate summaries.
Ingestion points: The agent reads screenshots, recordings, code diffs, and other repository data (specified in SKILL.md under the 'Slides' section).
Boundary markers: None. There are no instructions provided to the agent to treat embedded text within diffs or screenshots as data rather than instructions.
Capability inventory: The agent has the ability to write files ("writing and rendering the video, outside the repo"), execute rendering commands, and read files to verify frames.
Sanitization: None. The skill lacks instructions for sanitizing or escaping content found in diffs or screenshots before interpolation into the video generation process.
[DATA_EXPOSURE]: The agent is tasked with aggregating sensitive project information, including code changes (diffs) and visual recordings, and transforming them into a video format stored outside the controlled repository environment. While no network exfiltration is explicitly defined, the movement of processed sensitive data to arbitrary locations on the filesystem increases the risk of exposure.

ketchup-video