The Agent Skills Directory

[DYNAMIC_EXECUTION]: The scripts/narrate.mjs script dynamically imports a JavaScript module from a file path passed as a command-line argument. While used to load the required TTS library, this pattern of loading code from a computed path is a security surface.
[COMMAND_EXECUTION]: The skill executes ffmpeg and ffprobe using the execFileSync method. In scripts/assemble.mjs, the command arguments, including video metadata and captions, are constructed using strings derived from user-provided JSON files.
[INDIRECT_PROMPT_INJECTION]: The skill processes external data from scenes.json and timeline.json to generate narration audio and video overlays. This ingestion of untrusted data into prompts (via TTS) and command-line tools (via metadata) represents a vulnerability surface. Current sanitization is limited to basic escaping for FFmpeg metadata.
Ingestion points: scenes.json (read in narrate.mjs), timeline.json (read in assemble.mjs).
Boundary markers: None; the scripts parse raw JSON fields.
Capability inventory: execFileSync (ffmpeg, ffprobe), file system writes (writeFile), and dynamic module loading (import).
Sanitization: assemble.mjs includes a helper function to escape newlines and specific characters (\\, =, ;, #) for FFmpeg metadata output.
[EXTERNAL_DOWNLOADS]: The skill is designed to download the kokoro-js package from npm and model resources from HuggingFace during its setup process.

video-walkthrough