The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: Fetches a third-party repository from https://github.com/JohnHeibel/ClaudeAnimationBase using git clone. It also installs several Node.js packages (p5, p5.brush, puppeteer-core) from the NPM registry.
[REMOTE_CODE_EXECUTION]: Instructs the agent to execute code from the downloaded repository (node render.mjs) to render animation frames. Although a specific commit hash (0ac8bf2) is provided for verification, the code originates from a non-trusted external source.
[COMMAND_EXECUTION]: Uses several shell commands to manage the animation environment, including git clone, npm install, sed for file modification, chown for permission changes, and ffprobe for file verification. It specifically directs execution through a scripts/jail.sh sandbox.
[DYNAMIC_EXECUTION]: The skill's primary function involves writing drawing code (p5.js) that is executed at runtime via a headless browser to generate video frames.
[INDIRECT_PROMPT_INJECTION]: The skill requires reading and following an external API guide (ANIMATION_GUIDE.md) from the cloned repository. This creates a surface where instructions within the external guide could influence the agent's behavior.
Ingestion points: ANIMATION_GUIDE.md (cloned from JohnHeibel/ClaudeAnimationBase at runtime).
Boundary markers: None explicitly used when reading the external guide.
Capability inventory: Subprocess calls (git clone, npm install, node, ffprobe), file modification (sed), and file system access.
Sanitization: No explicit sanitization of the external guide content before processing.

animating-with-code