The Agent Skills Directory

[DATA_EXFILTRATION]: The skill's primary function is to capture visual artifacts of the workspace (screenshots and terminal recordings) and transmit them to external hosting providers.
[DATA_EXFILTRATION]: In 'Headless / Background Mode', the instructions explicitly direct the agent to upload artifacts directly to catbox.moe without a preview or approval step. This creates a high risk of leaking sensitive data if the automated credential scan fails or if the agent captures sensitive code, environment variables, or UI states.
[EXTERNAL_DOWNLOADS]: The scripts/capture-demo.py script and references/upload-and-approval.md instructions utilize curl to transmit data to catbox.moe and litterbox.catbox.moe, which are third-party file hosting services not included in the trusted vendors list.
[COMMAND_EXECUTION]: The skill makes extensive use of the subprocess module to execute external binaries including ffmpeg, ffprobe, vhs, silicon, and aws.
[COMMAND_EXECUTION]: The skill dynamically generates .tape files for the vhs recording tool. These files contain commands derived from untrusted sources such as branch names and pull request descriptions, which could lead to command injection if not properly sanitized by the agent before writing the file.
[CREDENTIALS_UNSAFE]: The skill requires access to Cloudflare R2 credentials (R2_ACCESS_KEY_ID, R2_SECRET_ACCESS_KEY) and instructs the agent to read these from the environment for use with the AWS CLI for permanent hosting.

demo-reel