The Agent Skills Directory

[COMMAND_EXECUTION]: The skill makes extensive use of local command-line utilities for media processing. This includes using ffmpeg and ffprobe for video extraction and analysis, and the demucs library for source separation of audio tracks. These operations are performed via subprocess.run in Python and child_process.spawn in Node.js, which are necessary for the skill's primary function of video creation.
[EXTERNAL_DOWNLOADS]: The scaffold.sh setup script fetches several resources from external domains. It downloads Open Font License (OFL) fonts from the official Google Fonts GitHub repository (raw.githubusercontent.com/google/fonts). It also installs required runtime dependencies from the standard npm and PyPI registries, including a specialized music information retrieval package (beat-this) from a recognized academic repository at Johannes Kepler University Linz.
[DYNAMIC_EXECUTION]: The core of the video engine relies on dynamic code execution within a browser environment. It uses Playwright to launch a headless Chrome instance where the three.js rendering engine runs. The engine dynamically imports and executes scene-specific JavaScript files generated or modified by the agent to produce the final video frames.
[INDIRECT_PROMPT_INJECTION]: The skill architecture involves processing external, potentially untrusted data which presents a surface for indirect prompt injection. This data is ingested during song transcription and through web research tasks assigned to sub-agents.
Ingestion points: Untrusted data enters the context via analysis/research_*.md (web search results) and analysis/lyrics.txt (transcribed or user-supplied lyrics).
Boundary markers: The skill employs structured templates for sub-agent briefs to define scope and constraints, reducing the likelihood of accidental instruction obedience from data.
Capability inventory: The skill environment has broad capabilities including file system access, shell command execution, and network operations (via Scenario API).
Sanitization: While the workflow encourages human-in-the-loop verification of lyrics and research, there is no automated sanitization of data before it is processed by sub-agents or the lead agent.

scenario-kinetic-music-video