The Agent Skills Directory

[COMMAND_EXECUTION]: The test runner script (scripts/run_test_matrix.py) uses subprocess.run to execute internal scripts for automated testing. This is implemented using a list of arguments and avoids the use of shell=True, which is a secure practice for calling known executables.
[DATA_EXPOSURE]: The script scripts/prepare_chat_overlay_bundle.py includes functionality to copy local avatar images into the generated project bundle. The script implements a validate_output_dir check to ensure that the tool does not overwrite critical directories like the user's home or the skill's source files.
[INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied transcripts and screenshots to generate motion overlays.
Ingestion points: Transcript files and screenshot content processed via instructions in SKILL.md and references/input-format.md.
Boundary markers: The agent is instructed to normalize all input into a specific transcript format defined in references/input-format.md before processing, serving as a structural boundary.
Capability inventory: The skill can read local avatar files, write to a generated bundle directory, and execute shell commands for rendering via the Remotion CLI.
Sanitization: scripts/build_chat_overlay_spec.py uses regex parsing to validate transcript structure, and scripts/prepare_chat_overlay_bundle.py sanitizes and resolves file paths before copying assets.

chat-motion-overlay