The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The rendering script fetches the 'Inter' font from Google Fonts (fonts.googleapis.com) to calculate text dimensions. This is a well-known service.- [COMMAND_EXECUTION]: The scripts/make_bubbles.py script executes the ImageMagick convert utility via subprocess.run to create gradient wash images. The implementation is secure as it uses a list of arguments rather than a shell string, preventing command injection.- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from video transcripts to populate the chat bubbles.
Ingestion points: Transcript data is retrieved via get_transcript and used to pre-fill the ask_form in SKILL.md.
Boundary markers: None explicitly defined for the transcript, but the output is processed as plain text.
Capability inventory: The skill can write files, execute convert via subprocess, and perform network uploads via curl.
Sanitization: The Python script uses textContent in Playwright to measure text, which prevents script execution in the rendering context. The human-in-the-loop confirmation step ('Ask first') acts as a primary security boundary against malicious instructions in the transcript.

text-bubble-stack