The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests and processes external data from multiple sources, creating a potential attack surface for indirect prompt injection. Malicious instructions embedded in these files could influence the agent's behavior when it processes the content for the user.
Ingestion points:
Fetches and parses JSON caption files in rules/display-captions.md.
Parses external .srt subtitle files in rules/import-srt-captions.md.
Ingests data from remote URLs via props.dataUrl in rules/calculate-metadata.md.
Processes transcription output from Whisper.cpp in rules/transcribe-captions.md.
Ingests lineCoordinates and GeoJSON data in rules/maps.md.
Boundary markers: No explicit delimiters or instructions to ignore embedded commands are present in the provided code snippets when interpolating untrusted text into components (e.g., {token.text}, {typedText}).
Capability inventory: The skill utilizes execSync for FFmpeg operations in rules/transcribe-captions.md and performs various network operations using fetch to retrieve data and assets.
Sanitization: There is no evidence of sanitization or validation logic for the text content rendered in video components, leaving the system susceptible to instructions hidden in processed media data.
[EXTERNAL_DOWNLOADS]: The skill encourages downloading and installing numerous packages and assets from external sources.
Fetches Lottie animation data from assets4.lottiefiles.com in rules/lottie.md.
Downloads sound effects from remotion.media and references the soundcn GitHub repository in rules/sfx.md.
Installs whisper.cpp and related models from the ggml-org GitHub repository in rules/transcribe-captions.md.
These downloads target well-known or trusted services and organizations, which aligns with standard development practices for the Remotion ecosystem.
[COMMAND_EXECUTION]: The skill provides instructions for executing shell commands and Node.js subprocesses.
Uses npx create-video for project scaffolding and npx remotion for Studio, rendering, and package management across several files.
Utilizes execSync to invoke ffmpeg for audio conversion in rules/transcribe-captions.md.
These operations are consistent with the primary purpose of building and rendering programmatic videos.

remotion-best-practices