The Agent Skills Directory

[COMMAND_EXECUTION]: The skill frequently executes external CLI tools using subprocess.run and execFileSync. Tools called include ffmpeg, ffprobe, node, python3, and the hyperframes CLI. These are used for video rendering, metadata extraction, and running validation scripts.
[DYNAMIC_EXECUTION]: The skill dynamically generates index.html files containing JavaScript (GSAP) and executes them using the hyperframes CLI and a headless browser (Puppeteer) to render animation frames. This runtime code generation and execution is a core part of the skill's automation.
[EXTERNAL_DOWNLOADS]: The skill initiates the installation of external software packages, including hyperframes, gsap, and puppeteer-core, through a separate setup script (setup.py). These dependencies are fetched from public registries (npm, GitHub).
[INDIRECT_PROMPT_INJECTION]: The skill has an attack surface for indirect prompt injection as it ingests untrusted data from captions.json and visuals.json (originating from user transcripts and other agent steps). This data is interpolated into design briefs and executable HTML files, which are then processed by a secondary agent and rendered as code.
Ingestion points: Reads visuals.json, captions.json, and images.json in scripts/motion.py.
Boundary markers: Absent; transcript text is directly interpolated into markdown briefs and HTML templates without clear delimiters or 'ignore' instructions.
Capability inventory: Includes file system writes, extensive shell command execution (ffmpeg, node, hyperframes), and execution via a headless browser.
Sanitization: Employs json.dumps for JavaScript interpolation, but lacks specific sanitization for content placed in markdown-formatted design briefs.

motion