The Agent Skills Directory

[OBFUSCATION]: The RELEASE_NOTES.md file explicitly states that the project uses a 'Minified + obfuscated production build'. Obfuscation is a technique used to hide the underlying logic of a script, which is a significant security concern for AI skills as it prevents the agent and auditors from verifying the safety of the code.
[COMMAND_EXECUTION]: The installation scripts (scripts/install.sh, scripts/install.cmd, and scripts/install.ps1) contain logic to navigate three directory levels above the script location (../../..) to define a project root. They then proceed to execute npm install and npm run build in that target directory. This behavior attempts to access and modify the file system and install dependencies outside of the skill's restricted environment.
[EXTERNAL_DOWNLOADS]: The installation process triggers npm install, which downloads numerous external dependencies from the NPM registry. Since the package.json file is not provided in the skill manifest, these dependencies cannot be audited for supply chain risks or malicious payloads.

media-generation