The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill utilizes esbuild to compile choreography scripts (e.g., src/minimal.ts or src/v15.ts) into temporary modules, which are then dynamically imported and executed by helper scripts during validation.
Evidence: assets/starter/scripts/check-geometry.mjs and assets/starter/scripts/check-visibility.mjs use build from esbuild to generate a temporary file and then call await import(pathToFileURL(tmp)) to execute the compiled code.
[EXTERNAL_DOWNLOADS]: The skill includes instructions for the agent to perform self-updates by fetching and merging code from a remote Git repository.
Evidence: SKILL.md and references/updates.md instruct the agent to use git fetch and git pull from https://github.com/olafBobryk/averlo-tool-motion-studio.git. This is identified as a vendor-owned resource.
[COMMAND_EXECUTION]: The skill requires the execution of various shell commands for project setup, dependency management, and media rendering.
Evidence: README.md and SKILL.md list commands such as python3 scripts/create_project.py, npm ci, npm run render, and Git operations.
[INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied image assets to generate motion films, creating a potential attack surface for indirect prompt injection through data ingestion.
Evidence Chain:
Ingestion points: User-supplied PNG images and SVG marks (e.g., frame-01.png, averlo-mark.svg) are loaded into the project environment.
Boundary markers: No explicit prompt delimiters or warnings for treating data as untrusted are provided.
Capability inventory: The skill can perform file system operations, dynamic code execution, network operations (Git updates), and browser-based rendering.
Sanitization: scripts/create_project.py performs basic validation of PNG headers and image dimensions.

averlo-motion-studio