The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The scripts/package-loader.mjs utility script downloads external dependencies, including @hyperframes/producer and sharp, from the npm registry at runtime using npm install with the --ignore-scripts flag.
[DYNAMIC_EXECUTION]: The skill dynamically loads and executes code from the downloaded npm packages. Specifically, scripts/package-loader.mjs uses await import() to load modules from a temporary directory after they are installed.
[COMMAND_EXECUTION]: The skill scripts and instructions rely on executing shell commands for video production, dependency management, and transcription. It uses spawnSync for npm and node in scripts/package-loader.mjs, and instructs the agent to run npx hyperframes and od media commands in SKILL.md.
[INDIRECT_PROMPT_INJECTION]: The skill processes external audio and video files to generate transcripts that the agent is then instructed to read and verify. This creates an attack surface where malicious instructions hidden in transcripts could influence agent behavior.
Ingestion points: transcript.json files generated by the hyperframes transcribe command.
Boundary markers: Instructions direct the agent to "read the transcript and check for quality issues," but do not establish strict data boundaries or delimiters.
Capability inventory: The skill has the ability to write files, execute shell commands, and perform network operations via npm.
Sanitization: No explicit sanitization of transcript content is performed before the agent processes it.

hyperframes