The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses shell commands to manage the work environment, including directory creation (mkdir), file operations (cp, ln, sed), and executing CLI utilities.
[EXTERNAL_DOWNLOADS]: At runtime, the skill downloads and executes the latest version of the vendor's CLI tool from NPM using npx -y @notedit/vtake@latest. It also relies on the hyperframes package from NPM for video rendering.
[EXTERNAL_DOWNLOADS]: By default, the transcription process communicates with an external API service at https://vtake.app/api/transcribe when a local ElevenLabs API key is not configured.
[REMOTE_CODE_EXECUTION]: The skill dynamically generates HTML card fragments and a master JavaScript (GSAP) timeline based on the video transcript. This generated code is executed within a browser context by the hyperframes renderer to produce the final MP4 video.
[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface (Category 8) because it ingests untrusted transcription data and interpolates it into the generated HTML/JS. While the skill documentation mandates a linting process via hyperframes to block <script> tags, external URLs, and inline event handlers, the underlying risk of processing untrusted content into executable structures remains.

vtake-cut