The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill fetches libraries (React, Babel) from unpkg.com, fonts from Google Fonts, and various assets like logos from svgl.app and simpleicons.org. These are well-known and reputable service providers.
[COMMAND_EXECUTION]: The skill utilizes several local command-line tools to perform its tasks, including ffmpeg and ffprobe for video/audio processing, playwright for HTML rendering and validation, and git for update checking. These executions are necessary for the skill's stated functionality.
[DATA_EXFILTRATION]: Optionally, the skill can send video segments or text to ByteDance's Volcengine APIs for AI-powered video review and text-to-speech. This behavior is explicitly declared in SECURITY.md, requires the user to provide their own API keys in a .env file, and implements a consent gate requiring a --yes flag or environment variable before execution. To prevent key leakage, the code validates that API endpoints belong to authorized domains (bytedance.com or volces.com).
[INDIRECT_PROMPT_INJECTION]: As the skill processes user-supplied text and external Markdown files to generate design outputs, there is a theoretical surface for indirect prompt injection. However, no malicious exploitation patterns were found in the provided logic.
[DYNAMIC_EXECUTION]: The skill uses Playwright's evaluate function to run JavaScript within a headless browser for capturing element coordinates and screenshots. It also uses localized Python code execution to calculate values like video frame rates from tool outputs.

huashu-design