The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The script scripts/kokoro-say.py downloads binary ONNX models and voice data files from a third-party GitHub repository (github.com/thewh1teagle/kokoro-onnx). While these resources are required for the skill's local TTS functionality, they originate from a non-official/unverified source.
[INDIRECT_PROMPT_INJECTION]: The skill uses a browser via playwright-core to render AI-generated HTML content (index.html) that incorporates user-supplied topics. This workflow is vulnerable to indirect prompt injection where a malicious topic could influence the generated HTML to include scripts that execute in the agent's browser context.
Ingestion points: User-provided topic and arguments via the $ARGUMENTS placeholder in SKILL.md.
Boundary markers: No specific delimiters or safety instructions are defined to separate user-controlled data from the HTML structure.
Capability inventory: The scripts/make-video.mjs script launches a Chromium browser, navigates to local file:// URLs, and takes screenshots of the rendered content. It also executes shell commands for video encoding.
Sanitization: The skill does not specify sanitization or escaping requirements for the topic before it is used to generate the interactive web page or the video narration script.
[COMMAND_EXECUTION]: The skill makes extensive use of external command-line tools. scripts/make-video.mjs spawns ffmpeg and ffprobe for media processing, and the skill instructions require pnpm for dependency management. Additionally, it executes uv to run a Python script for audio generation.

explain