The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill uses a template-based architecture where user-provided or agent-provided data is interpolated into HTML and JavaScript snippets through placeholders.
Ingestion points: Data is injected into rendering templates in several files, including rules/asr-keyword-glow.md, rules/discrete-text-sequence.md, and rules/dynamic-content-sequencing.md using tokens like {Brand}, {phrase}, and {label}.
Boundary markers: Absent. The templates do not utilize specific delimiters to isolate user data from executable code logic.
Capability inventory: The generated code is designed to execute in a browser environment with access to powerful APIs such as WebGL, WebGPU, and the DOM, as referenced in adapters/three.md and adapters/typegpu.md.
Sanitization: Absent. The skill lacks instructions or mechanisms for sanitizing strings before they are inserted into the DOM or used in script logic, creating a surface for potential Cross-Site Scripting (XSS) or indirect prompt injection if the rendered output is interpreted by other agents.
[EXTERNAL_DOWNLOADS]: The skill references and includes snippets that load external JavaScript dependencies from well-known content delivery networks (CDNs).
Fetches the GSAP library from cdn.jsdelivr.net.
Fetches Lottie and dotLottie players from cdnjs.cloudflare.com and unpkg.com.
Fetches Three.js and Anime.js from cdn.jsdelivr.net.
[COMMAND_EXECUTION]: The skill provides documentation and instructions for executing local utility scripts for animation auditing and data extraction.
SKILL.md describes the execution of a Node.js script: node skills/hyperframes-animation/scripts/animation-map.mjs.
rules/gsap-effects.md mentions a Python script for audio processing: python skills/hyperframes-creative/scripts/extract-audio-data.py.

hyperframes-animation