The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute various shell commands using npx, npm, yarn, pnpm, and bun to scaffold projects, install dependencies, and perform video rendering tasks. (SKILL.md, rules/ffmpeg.md, rules/maps.md)
[EXTERNAL_DOWNLOADS]: The skill fetches resources from external domains, including remotion.media for assets and sound effects, assets4.lottiefiles.com for Lottie animations, and Google Fonts for typography. (rules/sfx.md, rules/lottie.md, rules/google-fonts.md)
[REMOTE_CODE_EXECUTION]: The skill utilizes @remotion/install-whisper-cpp to download and install specific versions of the Whisper.cpp binary and models to the local project directory for audio transcription. (rules/transcribe-captions.md)
[INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface for indirect prompt injection by ingesting and processing untrusted external data.
Ingestion points: API responses fetched in calculateMetadata, Lottie JSON data from external URLs, and .srt subtitle files parsed via parseSrt. (rules/calculate-metadata.md, rules/lottie.md, rules/import-srt-captions.md)
Boundary markers: The instructions do not specify the use of delimiters or 'ignore' instructions when interpolating external data into the project.
Capability inventory: The skill environment has access to file system writes (fs.writeFileSync), network operations (fetch), and shell command execution (npx remotion). (rules/transcribe-captions.md, SKILL.md)
Sanitization: There is no evidence of sanitization or strict schema validation for external data before it influences the rendering process or metadata calculation.

remotion-best-practices