The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes child_process.spawn to execute the ffmpeg and ffprobe system utilities. These tools are used for video metadata extraction, frame-by-frame visual analysis, and converting WebM recordings to MP4 format (e.g., in scripts/convert-mp4.mjs and scripts/review-frames.mjs). The arguments are passed as arrays, which prevents shell injection vulnerabilities.
[EXTERNAL_DOWNLOADS]: The README.md setup instructions require the user to download the Chromium browser using the Playwright CLI (pnpm exec playwright install chromium) and install the FFmpeg utility. These are established tools provided by Microsoft and the FFmpeg project respectively.
[PRIVILEGE_ESCALATION]: The README.md file contains a setup command for Linux users that uses sudo (sudo apt-get install -y ffmpeg) to install a required system dependency. This is a standard administrative procedure for software installation.
[INDIRECT_PROMPT_INJECTION]: The skill has an inherent attack surface because it ingests and processes content from external web applications during the recording process.
Ingestion points: The run-walkthrough.mjs script captures the DOM state, console logs, and network traffic of the target web application.
Boundary markers: The skill includes a sensitivity scanner in scripts/walkthrough-config.mjs designed to identify and redact sensitive information like GitHub tokens and AWS keys before they are saved to reports.
Capability inventory: The skill can execute local binaries (ffmpeg/ffprobe), write files to the local disk (video artifacts and screenshots), and control a headless browser.
Sanitization: The skill uses a redactedMessage function to filter sensitive patterns from error messages and logs, reducing the risk of accidental data exposure.

product-walkthrough-video