The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts/prepare-release.py helper script utilizes subprocess.run to interact with the GitHub CLI (gh). It executes commands to fetch version information and repository content from the official remotion-dev organization. The commands use a list-based argument structure which prevents shell injection.
[EXTERNAL_DOWNLOADS]: The skill fetches release tarballs from the vendor's official GitHub repository at github.com/remotion-dev/codex-plugin. This is a standard operation for packaging and updating the plugin to the latest stable version.
[DYNAMIC_EXECUTION]: The SKILL.md instructions include a command to run a linting process using bun -e. This executes a JavaScript snippet that imports and runs the @microsoft/vally library to validate the staged package structure.
[INDIRECT_PROMPT_INJECTION]: The skill represents a surface for indirect prompt injection as it processes and packages content from external archives (user-provided ZIP and GitHub tarballs).
Ingestion points: Content is ingested via the --published-zip argument and the GitHub API tarball download in scripts/prepare-release.py.
Boundary markers: None identified; the skill is designed to preserve and package file content as-is.
Capability inventory: The skill has the ability to execute shell commands via subprocess and JavaScript via bun.
Sanitization: The Python helper script implements safety checks to prevent directory traversal by validating that archive entries do not contain .. or absolute paths, and uses strict regex for version validation.

update-codex-plugin