The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest untrusted data from the web which then influences the agent's behavior and the content of generated scripts.
Ingestion points: scripts/site-kit.mjs fetches text, headings, and metadata from arbitrary URLs; scripts/ref-sheet.mjs fetches post text from social media links.
Boundary markers: The skill includes explicit instructions in SKILL.md and warnings in generated files (like brand/site.md) telling the agent to treat site content as data and not as instructions.
Capability inventory: The skill can perform file system writes, network requests, and execute arbitrary shell commands via spawned processes.
Sanitization: Basic text normalization is performed, but the defense relies primarily on agent instructions.
[COMMAND_EXECUTION]: The skill relies heavily on executing external binaries to perform its core functions.
Evidence: Uses child_process.spawn, spawnSync, and fork to run ffmpeg, ffprobe, yt-dlp, and various Chromium-based browsers.
Context: While arguments are generally passed as arrays (reducing shell injection risk), the inherent complexity of media processors and browsers presents a vulnerability surface when acting on untrusted inputs.
[EXTERNAL_DOWNLOADS]: The skill fetches data and media from the internet based on user-provided links.
Evidence: scripts/lib/net.mjs contains logic to stream content from URLs into local files.
Mitigation: Includes a robust SSRF protection mechanism (assertPublic) that manually follows redirects and validates every hop against a blacklist of local and private IP ranges.

motion-graphics