The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts/html_render.py script executes Chromium-family browsers (such as Chrome, Edge, or Brave) using subprocess.run to render media overlays. The command is constructed using a list of arguments and specific headless flags, which mitigates command injection risks while providing the skill's core rendering functionality.
[EXTERNAL_DOWNLOADS]: The skill downloads font files from external sources, including Google Fonts and user-specified URLs in the payload, using urllib.request. These downloads are functionally necessary for custom typography and are limited to font assets.
[INDIRECT_PROMPT_INJECTION]: The skill ingests JSON payloads that contain Mustache and HTML templates via scripts/templating.py and scripts/html_render.py. This allows the processing of external data which could potentially contain prompt instructions or browser-based injection if the payloads originate from untrusted sources.
Ingestion points: JSON payload files are processed by overlay.py to define overlay content.
Boundary markers: The skill does not implement specific boundary markers to delimit user-provided text within templates.
Capability inventory: The skill has the capability to execute local browser binaries and perform network requests to fetch fonts.
Sanitization: Plain text layers are sanitized using html.escape, while rich HTML layers are rendered as raw fragments to support complex CSS and layout features.

scenario-text-overlay