The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill describes patterns for fetching and processing data from external URLs or user-supplied properties, which can serve as an injection surface for untrusted instructions.
Ingestion points: Multiple rule files, including rules/calculate-metadata.md (props.dataUrl), rules/display-captions.md (JSON captions), rules/lottie.md (Lottie JSON), and rules/voiceover.md (ElevenLabs API responses), ingest data into the agent's context.
Boundary markers: The provided code snippets do not consistently use delimiters or specific warnings to ignore embedded instructions in the ingested data.
Capability inventory: The skill documentation involves use of fetch, npx/bunx for package management, and subprocess calls for FFmpeg and Whisper.cpp transcription.
Sanitization: No explicit sanitization, validation, or escaping of fetched data is demonstrated in the provided code examples.
[REMOTE_CODE_EXECUTION]: The skill provides instructions for downloading and installing external components that execute at runtime.
Evidence: In rules/transcribe-captions.md, the @remotion/install-whisper-cpp library is used to download and install the whisper.cpp binary and associated models to the local project directory for execution.
[EXTERNAL_DOWNLOADS]: The documentation frequently recommends installing third-party NPM packages and fetching assets from various remote servers.
Evidence: The skill guides users to install numerous framework-specific packages and fetch media assets from well-known services such as Lottiefiles, ElevenLabs, and Remotion's official asset domain.
[COMMAND_EXECUTION]: The instructions include various shell commands for the user or agent to perform development tasks.
Evidence: Documentation in rules/ffmpeg.md and rules/maps.md utilizes framework CLI tools like bunx remotion ffmpeg for critical media processing operations.

remotion-best-practices