The Agent Skills Directory

[COMMAND_EXECUTION]: The skill invokes shell commands via npm run for capturing footage, performing text-to-speech, and rendering the final video. It also utilizes git commands to check for repository updates and freshness.\n- [REMOTE_CODE_EXECUTION]: The skill executes local project-specific JavaScript files (flow.mjs, reset.mjs) to handle UI automation. Additionally, it supports updating its own renderer and logic by performing a git pull from the vendor's repository (new-xp/ultrademo), an action that is gated by user confirmation.\n- [EXTERNAL_DOWNLOADS]: The skill connects to the new-xp/ultrademo GitHub repository to fetch updates and configuration. These resources are owned by the skill author and the update process is transparent to the user.\n- [PROMPT_INJECTION]: The skill presents an attack surface for indirect prompt injection by ingesting data from external application codebase diffs and project files. It addresses this risk through a mandatory evidence chain including ingestion points (codebase diffs, project files), capability inventory (npm and git execution), and robust sanitization measures (secrets sweep, redaction, and a manual review gate).

ultrademo-rerun