The Agent Skills Directory

[CREDENTIALS_UNSAFE]: A hardcoded API key was detected in the configuration files provided with the skill.
Evidence: The file .env.local contains a plaintext ELEVENLABS_API_KEY set to sk_9c13fba7eef4e419eff512a512080b233e646dcb2f4645e4. Hardcoding active or realistic secrets poses a security risk for credential theft.
[EXTERNAL_DOWNLOADS]: The skill fetches code and dependencies from external sources during execution.
Evidence: scripts/setup.sh installs the playwright library from the NPM registry.
Evidence: scripts/doctor.mjs and scripts/compose.mjs execute the hyperframes utility via npx from the NPM registry.
Evidence: scripts/compose.mjs downloads the GSAP animation library directly from https://cdn.jsdelivr.net/npm/gsap@3.14.2/dist/gsap.min.js using curl.
[COMMAND_EXECUTION]: The skill's operation relies on a complex pipeline of system-level command executions.
Evidence: The scripts batch.mjs, run.mjs, and compose.mjs use spawn and execFile to invoke other Node.js scripts and system binaries including ffmpeg, ffprobe, and bash for media processing and automation tasks.

auto-loom