The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill instructions and referenced documents describe access to sensitive local credential files, including ~/.heygen/credentials and ~/.aws/credentials, to facilitate authentication with cloud rendering services. Commands such as auth status and usage are used to retrieve and display account-specific metadata, including subscription tiers, billing snapshots, and spend limits.
[DATA_EXFILTRATION]: The skill includes a feedback command designed to send reproduction packets and diagnostic reports to a public channel for maintenance. While the instructions emphasize manual anonymization of paths and secrets, the command automatically attaches a doctorSummary containing host environment details (OS, CPU, Memory, Node.js version). Additionally, the telemetry feature emits anonymous usage counters that include environment fingerprints to identify sandboxed or agent-specific runtimes (e.g., gVisor, Firecracker, Docker).
[EXTERNAL_DOWNLOADS]: The skill fetches several components from external sources to support its operations. It utilizes npx to execute the hyperframes package from the npm registry, downloads a pinned version of Chromium via browser ensure, and retrieves a ~33 MB ONNX model and tokenizer from a remote repository for local semantic search functionality. The skills command also installs additional agent instructions directly from GitHub.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data, creating an attack surface for indirect prompt injection.
Ingestion points: Untrusted data enters the agent context through npx hyperframes capture <url>, the init command processing external audio/video files, and the agent reading project files like index.html and sub-compositions.
Boundary markers: The skill does not define specific delimiters or instructions to ignore embedded commands when the agent interpolates or analyzes data from these external sources.
Capability inventory: The skill possesses extensive capabilities, including local file writes (init, capture), network operations (cloud render, publish, auth), and execution of commands via AWS Lambda and Google Cloud Run.
Sanitization: The instructions recommend redacting absolute paths and secrets from feedback reports, but no automatic sanitization or filtering is applied to data ingested during the project analysis and editing loop.

hyperframes-cli