The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external sources such as web pages, news articles, and tweets to generate graphics.
Ingestion points: categories/webpage/module.md, categories/tweet/module.md, and categories/news/module.md describe workflows for capturing and processing external web content.
Boundary markers: The instructions mention inspecting capture results and checking for BLOCKED.md, but there are no explicit prompts instructing the sub-agents to ignore potentially malicious instructions embedded in the ingested content.
Capability inventory: The skill can write files, execute shell commands (via Puppeteer, FFmpeg), and generate/execute JavaScript code.
Sanitization: Lacks robust sanitization to prevent adversarial content in the ingested data from influencing the Director or Builder agents.
[COMMAND_EXECUTION]: Several files execute shell commands and system binaries.
grounding/locate.mjs executes ffmpeg, ffprobe, and base64 via execFileSync.
categories/maps/bake-basemap.mjs executes ffmpeg and launches a browser via puppeteer-core.
SKILL.md uses npx to execute hyperframes CLI tools for initialization, updates, and rendering.
[EXTERNAL_DOWNLOADS]: The skill relies on external code and assets fetched at runtime.
SKILL.md uses npx to download and run the hyperframes package from the NPM registry.
categories/maps/bake-basemap.mjs injects scripts into a browser environment that fetch libraries from cdn.jsdelivr.net (MapLibre GL, TopoJSON, World Atlas).
Map rendering in bake-basemap.mjs fetches tiles from external providers like ArcGIS and Carto.
[DYNAMIC_EXECUTION]: The skill dynamically generates and executes code.
The Builder agent (agents/builder.md) is designed to author compositions/index.html programmatically based on user requirements.
bake-basemap.mjs generates an HTML string with embedded JavaScript and executes it within a Puppeteer headless browser instance.
[PRIVILEGE_ESCALATION]: categories/maps/bake-basemap.mjs launches Puppeteer with the --no-sandbox argument. While the file contains a comment stating this is intentional for certain environments (Root/CI), this flag disables a primary security boundary in the browser, increasing risk if the rendered content is untrusted.

motion-graphics