The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user data (song metadata, cast visual notes, shot descriptions) which are then interpolated into prompts for image and video generation backends.
Ingestion points: Data is ingested via content/kelly-mv-app/app/js/providers/busabase-provider.js (reading from Busabase Bases) and UI forms in content/kelly-mv-app/app/js/workspace-views.js.
Boundary markers: The skill uses basic structural separation in prompts (e.g., in content/kelly-mv-app/app/js/mv-model.js), but lacks robust delimiters to prevent embedded instructions from influencing the generation models.
Capability inventory: The skill can perform network operations (calling external image APIs), write to the filesystem (via Busabase storage), and execute local Python scripts via subprocesses.
Sanitization: Basic HTML escaping is performed in the frontend (app.js), but there is no specialized sanitization for text being sent to LLM/Image generation prompts.
[COMMAND_EXECUTION]: Several trusted scripts execute local processes to fulfill generation requests.
scripts/gen_draft_video.mjs spawns a Python process to run inference.py from a local ltx-video installation.
scripts/generate_song_draft.mjs spawns scripts/gen_song.py (currently a stub).
These are functional requirements for the skill's local ML integration and use hardcoded or validated script paths.
[EXTERNAL_DOWNLOADS]: The skill interacts with external services to fulfill its primary purpose.
scripts/execute_generation_requests.mjs makes POST requests to an OpenAI-compatible image generation API (defaults to moonrouter.dev) using an API key provided via environment variables.

kelly-mv