The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes multiple system commands to perform its core tasks. This includes calling ffmpeg for video encoding, ffprobe for file verification, and swift to run a helper script. Additionally, the Swift script invokes /usr/sbin/screencapture to capture parts of the screen.
[DYNAMIC_EXECUTION]: The script scripts/render_browser_demo.py includes a hardcoded Swift source code string (SWIFT_CURSOR_CAPTURE) that is executed at runtime via the swift interpreter. This allows the skill to perform low-level macOS API calls for cursor position and matte extraction without shipping a compiled binary.
[INDIRECT_PROMPT_INJECTION]: The skill processes user-influenced data through a JSON configuration file, presenting a potential attack surface.
Ingestion points: The scripts/render_browser_demo.py script reads a JSON configuration file provided via the --config command-line argument to determine file paths, timing, and animation coordinates.
Boundary markers: The script does not utilize explicit boundary markers or "ignore instructions" delimiters for the content specified in the JSON config.
Capability inventory: The execution environment for the rendering script includes filesystem access (via Pillow), video processing (via ffmpeg), and system-level screen capture capabilities (via the Swift/screencapture sequence).
Sanitization: There is no evidence of sanitization or strict validation for the file paths or coordinate data provided in the JSON configuration before they are used in filesystem operations or subprocess arguments.

browser-video-recording