The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The workflow involves capturing content from user-provided URLs as described in references/step-1-capture.md. This external data is stored in extracted/visible-text.txt and extracted/asset-descriptions.md, and is subsequently used to influence the creation of DESIGN.md, SCRIPT.md, and STORYBOARD.md. The instructions lack explicit boundary markers or sanitization guidelines to ensure that instructions embedded in the source website do not override agent behavior.
[DYNAMIC_EXECUTION]: As detailed in references/step-6-build.md, the skill instructs the agent to generate and execute HTML and JavaScript files (compositions/*.html) based on a generated storyboard. These compositions use complex animation logic (GSAP) and include logic for deterministic rendering. While this is the core utility of the skill, it involves automated code generation from external data sources.
[COMMAND_EXECUTION]: The skill utilizes the npx hyperframes CLI for various tasks including website capture, audio transcription, and video validation. The capture command takes a user-supplied URL as a direct argument, which is a potential surface for command injection if the underlying platform does not properly escape inputs. Additionally, it executes a local script node skills/hyperframes-animation-map/scripts/animation-map.mjs for quality checks.
[EXTERNAL_DOWNLOADS]: The skill references and loads external JavaScript libraries from cdn.jsdelivr.net (GSAP and DotLottie) and typography from fonts.googleapis.com. These references are to well-known and established services used for legitimate development purposes and do not escalate the verdict.

website-to-hyperframes