The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes child_process.spawnSync to execute external binaries including ffmpeg, rsvg-convert, and a bundled Python script for SVG validation. These commands are used to process project assets and are subject to user approval checkpoints for tool installation.
[DYNAMIC_EXECUTION]: The export-readme-logo-animation.mjs script dynamically imports a local repository-owned module (animation recipe) using import(). This is used to define frame-by-frame rendering logic, which is then validated for safety before export.
[EXTERNAL_DOWNLOADS]: The skill identifies external system dependencies (ffmpeg, librsvg) and integrates with Higgsfield MCP for logo generation via Recraft. The instructions mandate a live preflight and explicit user approval for cost and installation before any such action is taken.
[INDIRECT_PROMPT_INJECTION]: The skill processes project README files, which are considered untrusted data. It mitigates injection risks by using a strict, root-bounded auditing script (audit-readme-logo-assets.mjs) that validates all file references and prevents access outside the declared repository root.
[CREDENTIALS_SAFE]: Instructions and internal checks explicitly forbid the inclusion of secrets, private paths, or internal hostnames in assets or prompts. The skill also enforces the use of .env files for secret management where applicable.

animated-readme-logo