The Agent Skills Directory

[DYNAMIC_EXECUTION]: The script scripts/package-loader.mjs implements a custom mechanism to dynamically install and import Node.js packages (npm install) during execution. It creates temporary directories to house these dependencies and then executes the parent script with a modified environment to load them.
[COMMAND_EXECUTION]: The skill performs shell command execution in multiple places:
scripts/package-loader.mjs uses spawnSync to run npm install for bootstrapping dependencies.
scripts/extract-audio-data.py uses subprocess.run to invoke ffmpeg for decoding audio files.
[EXTERNAL_DOWNLOADS]: The scripts/package-loader.mjs utility downloads external code from the NPM registry at runtime. While it enforces pinned versions and disables lifecycle scripts, this behavior bypasses static analysis of a project's dependency tree.
[INDIRECT_PROMPT_INJECTION]: The design picker functionality (templates/design-picker.html and references/design-picker.md) ingests untrusted user data (headlines and sublines) and interpolates them into HTML templates displayed in a browser environment. While the documentation instructs the model to avoid including scripts or event handlers in the generated HTML, this remains a surface for potential cross-site scripting (XSS) or UI redressing if the instructions are bypassed.

hyperframes-creative