The Agent Skills Directory

[DYNAMIC_EXECUTION]: The animation exporter script scripts/export-readme-logo-animation.mjs uses dynamic import() to load and execute JavaScript animation recipes from the project directory. This represents a risk of arbitrary code execution if the recipe files are modified or contain malicious logic.
[COMMAND_EXECUTION]: The skill uses spawnSync to execute local CLI tools, specifically rsvg-convert and ffmpeg, for image processing and animation encoding. The instructions provide a mandatory approval checkpoint before installing missing tools.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from the repository, including README Markdown and SVG files. While scripts/validate_logo_svg.py and scripts/audit-readme-logo-assets.mjs implement defensive parsing and root-boundary checks, the ingestion of complex data formats presents an inherent attack surface for indirect injection.
[EXTERNAL_DOWNLOADS]: The skill supports image generation via the Recraft model using an external Higgsfield MCP capability. The instructions include specific preflight requirements to confirm availability and costs, and they mandate explicit user approval before any network-based generation occurs.

animated-readme-logo