The Agent Skills Directory

[DYNAMIC_EXECUTION]: The script scripts/package-loader.mjs implements a dependency bootstrapping mechanism. It dynamically installs version-pinned packages from the npm registry into a temporary directory and subsequently uses dynamic import() to load them. While the script uses security-conscious flags like --ignore-scripts to prevent the execution of malicious package lifecycle scripts, the pattern of runtime code loading is a significant capability.
[INDIRECT_PROMPT_INJECTION]: The design-picker.html template and its integration instructions in references/design-picker.md create an injection surface. The tool interpolates user-provided strings (headlines, descriptions) and architecture-defined HTML into an interactive preview using innerHTML. While the documentation explicitly warns against including scripts or event handlers, this architecture could be exploited if malicious content is processed by the agent.
[COMMAND_EXECUTION]: The utility scripts/extract-audio-data.py executes the external ffmpeg binary using subprocess.run to perform audio decoding. The input file path is provided via command-line arguments. The implementation correctly passes arguments as a list to avoid shell injection vulnerabilities.
[EXTERNAL_DOWNLOADS]: The skill references and fetches resources from well-known and whitelisted services, including the gsap library via the jsDelivr CDN and various packages from the npm registry. These operations are consistent with the skill's media-processing objectives.

hyperframes-creative