The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill's documentation in SKILL.md provides instructions for users to install the heygen CLI by downloading a shell script and piping it directly into bash (curl -fsSL https://static.heygen.ai/cli/install.sh | bash). This is an insecure installation pattern, although the source is a recognized technology service.
[COMMAND_EXECUTION]: The skill performs shell-less execution of the heygen and ffprobe binaries to search for media and analyze file metadata. The implementation follows security best practices by using execFileSync with literal argument arrays to prevent command injection.
[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it incorporates untrusted data into its execution flow.
Ingestion points: Untrusted data enters the context via the --intent command-line argument in scripts/resolve.mjs and through the parsing of project-level design files (e.g., frame.md, design.md) in scripts/lib/brand-provider.mjs.
Boundary markers: The skill does not use specific delimiters or instructions to prevent the agent from following directions embedded within the media descriptions or design specs.
Capability inventory: Across its scripts (notably scripts/lib/heygen-search.mjs and scripts/lib/freeze.mjs), the skill has the ability to execute subprocesses, perform network requests to download files, and write those files to the local filesystem.
Sanitization: The skill effectively sanitizes input against command injection by avoiding shell interpolation, but it does not sanitize the natural language intent before passing it to search providers.
[EXTERNAL_DOWNLOADS]: The skill downloads media files (images, audio) from URLs provided by the HeyGen asset catalog.
Evidence: fetch() operations in scripts/lib/freeze.mjs are used to retrieve assets and save them locally.

media-use