The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted data from external sources, including live website URLs, GitHub Pull Requests, and Figma designs. This content is used to automatically generate video concepts and creative briefs.
Ingestion points: Website URLs, GitHub PR URLs, Figma designs, and user-supplied text briefs are identified as ingestion points in SKILL.md and references/workflow-catalog.md.
Boundary markers: The skill incorporates a mandatory confirmation loop where a summary of the inferred intent and brief is presented to the user for explicit approval before any workflow execution occurs.
Capability inventory: The skill possesses significant capabilities, including shell command execution (node, npx, gh, python), file system writes for project scaffolding and BRIEF.md generation, and network operations for site capture and content publishing.
Sanitization: While SVG sanitization is performed for Figma assets, there is no explicit documentation regarding the sanitization or delimiting of text extracted from GitHub PRs or website crawls when interpolated into the agent's context.
[EXTERNAL_DOWNLOADS]: The skill uses npx hyperframes skills update and npx skills add to fetch and install modular workflow skills and sub-compositions from remote repositories associated with the Heygen-com organization. These downloads are part of the framework's intended modular design.
[COMMAND_EXECUTION]: The skill relies on multiple CLI tools for its operations, including node for executing internal scripts, npx for managing the HyperFrames framework, gh (GitHub CLI) for retrieving PR metadata, and python for performing audio beat analysis.
[DATA_EXFILTRATION]: The npx hyperframes publish command is a functional feature that uploads the finished video composition to a remote server to provide a stable, shareable URL, which involves transmitting local project data to an external endpoint.

hyperframes