The Agent Skills Directory

[DYNAMIC_EXECUTION]: The categories/maps/bake-basemap.mjs script launches a headless browser via Puppeteer with the --no-sandbox flag enabled. This configuration removes critical security protections and could lead to system compromise if the browser processes malicious assets or navigates to harmful URLs.
[INDIRECT_PROMPT_INJECTION]: The skill's workflow involves fetching content from user-provided or searched URLs in the webpage, news, and tweet categories. This external data is then interpreted by subagents to generate the layout and code for the final composition, creating a vector for indirect injection attacks.
Ingestion points: External URLs and web content captured in phases/source/guide.md and category modules.
Boundary markers: The instructions do not define clear delimiters or warnings for subagents to ignore potentially malicious embedded instructions in the ingested data.
Capability inventory: The skill has the capability to execute shell commands (npx, ffmpeg) and execute generated JavaScript code within the HyperFrames composition environment.
Sanitization: There is no evidence of robust sanitization or schema enforcement on the data extracted from external web sources before it is passed to the subagents.
[COMMAND_EXECUTION]: Multiple scripts, including categories/maps/bake-basemap.mjs and grounding/locate.mjs, use spawnSync and execFileSync to run system utilities such as ffmpeg, ffprobe, base64, and the npx hyperframes CLI. These commands use arguments derived from environment variables and project-specific identifiers.
[EXTERNAL_DOWNLOADS]: The skill downloads various resources from external services during runtime, including libraries from cdn.jsdelivr.net (MapLibre, TopoJSON), map imagery from ArcGIS and CARTO, and geographical data from the world-atlas repository.
[DATA_EXFILTRATION]: The grounding/locate.mjs script includes an 'auto' mode that encodes local images into Base64 format and transmits them to the Google Gemini API (generativelanguage.googleapis.com) for object detection, which constitutes an external data transfer of potentially sensitive visual information.

motion-graphics