The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill implements patterns for ingesting untrusted data from external sources, creating a vulnerability surface where data could contain instructions meant to influence agent behavior.
Ingestion points: The calculateMetadata function in calculate-metadata.md fetches and parses JSON from a user-provided dataUrl. Additionally, lottie.md demonstrates fetching Lottie animation data from a remote URL.
Capability inventory: The skill possesses the capability to execute shell commands via npx remotion (e.g., in silence-detection.md and ffmpeg.md), perform network operations (e.g., fetch calls in voiceover.md), and write files to the local file system (e.g., in generate-voiceover.ts and prep-geo.mjs).
Boundary markers: The provided code snippets do not explicitly include boundary markers or delimiters to separate untrusted data from system instructions.
Sanitization: There is no evidence of explicit sanitization or validation of the fetched JSON structures before they are interpolated into the application props.
[EXTERNAL_DOWNLOADS]: The skill facilitates and recommends the use of several external services and CDNs for its primary functionality.
Well-known services: It fetches text-to-speech audio from ElevenLabs (api.elevenlabs.io), loads Lottie assets from assets4.lottiefiles.com, and utilizes unpkg.com to load MapLibre worker scripts.
Mapping providers: Instructions are provided for integrating with MapTiler, Mapbox, and Google Maps API, requiring the use of respective developer keys and remote tile services.
[DYNAMIC_EXECUTION]: The skill uses calculateMetadata to dynamically modify composition properties at runtime, though this is a standard feature of the Remotion framework and is used here for legitimate metadata calculations like video duration.

remotion-markup