The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The generate-tts.sh script performs network requests to openrouter.ai to retrieve audio data for the text-to-speech functionality. OpenRouter is a well-known provider for AI services, and these downloads are restricted to audio assets required for the skill's operation.
[COMMAND_EXECUTION]: The skill invokes the system utilities ffmpeg and ffprobe through subprocess calls in the generate-tts.sh script. These commands are used to transcode raw PCM audio streams into the WAV format and to extract duration metadata for proper video timing synchronization.
[DYNAMIC_EXECUTION]: The skill uses a Python HEREDOC pattern within a shell script to execute a static block of Python logic. This is a common and legitimate scripting technique for integrating Python-based data processing into a shell-based workflow and does not involve the execution of untrusted or dynamically constructed code strings.
[INDIRECT_PROMPT_INJECTION]: The skill processes structured scene data from an external slides.json file, which creates a surface for indirect prompt injection.
Ingestion points: The slides.json file, which contains the text and identifiers for each video slide, is read by both the TTS generation script and the Remotion animation components.
Boundary markers: The skill does not employ explicit delimiters or boundary markers for the slide content, relying on the JSON structure for data isolation.
Capability inventory: The skill possesses capabilities for writing to the filesystem (media assets), accessing the network (OpenRouter API), and executing system commands (ffmpeg/ffprobe).
Sanitization: There is a lack of explicit input sanitization on the slide identifiers (IDs) before they are used to construct local file paths, which represents a potential vulnerability surface for path traversal if malicious input is provided.

programmatic-video