The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill provides patterns for fetching and processing data from external sources which could be used to host malicious instructions.
Ingestion points: Data is fetched from external URLs in rules/calculate-metadata.md (via props.dataUrl), rules/lottie.md (Lottie JSON files), and rules/voiceover.md (ElevenLabs API responses). It also processes local files like captions and SRT subtitles.
Boundary markers: No specific delimiters or "ignore previous instructions" guards are implemented when processing these external inputs.
Capability inventory: The skill utilizes file system writes (fs.writeFileSync) and shell command execution (ffmpeg, ffprobe) in its workflow.
Sanitization: No explicit sanitization or validation of the fetched data is demonstrated in the provided code snippets.
[EXTERNAL_DOWNLOADS]: The skill provides instructions to download and install various tools and libraries.
[TRUST-SCOPE-RULE]: Fetches Lottie assets from assets4.lottiefiles.com, which is a well-known service for animation assets.
[TRUST-SCOPE-RULE]: Provides instructions to download and install the whisper.cpp binary using the @remotion/install-whisper-cpp package, an official utility for the Remotion ecosystem.
[TRUST-SCOPE-RULE]: Installs numerous standard Remotion and utility packages (e.g., @remotion/media, mapbox-gl, zod) from the NPM registry.
[COMMAND_EXECUTION]: The skill includes instructions for running system commands.
Executes ffmpeg and ffprobe via bunx remotion for video manipulation tasks like trimming and metadata extraction.
Demonstrates the use of child_process.execSync to run ffmpeg for audio format conversion in rules/transcribe-captions.md.
[CREDENTIALS_UNSAFE]: The skill handles API keys for Mapbox and ElevenLabs.
Encourages the safe practice of using .env files and environment variables (REMOTION_MAPBOX_TOKEN, ELEVENLABS_API_KEY) to manage sensitive credentials rather than hardcoding them.

remotion-best-practices