The Agent Skills Directory

[Indirect Prompt Injection]: The skill processes various external data sources, including media files (audio/video), subtitle files, and HTML compositions. This represents a potential surface for indirect prompt injection if the processed content contains adversarial instructions.
Ingestion points: The tool reads from index.html, the compositions/ directory, and media files passed via arguments like --video, --audio, or through the transcribe command.
Boundary markers: The skill documentation does not specify the use of delimiters or specific safety markers to differentiate between instructions and processed data.
Capability inventory: The tool can execute rendering processes, start a local web server for previews, and perform file system operations.
Sanitization: No explicit sanitization or input validation mechanisms for the content of the media or HTML files are described.
[External Downloads]: The skill leverages npx to fetch and execute the hyperframes package from the npm registry. This is a standard mechanism for using Node.js tools and ensures that the user is running the tool without manual global installation.
[Command Execution]: The workflow relies on executing shell commands to interact with the CLI tool. This is a core part of the skill's functionality for automating development and rendering workflows.

hyperframes-cli