The Agent Skills Directory

[REMOTE_CODE_EXECUTION]:
The script scripts/package-loader.mjs is designed to bootstrap missing Node.js dependencies at runtime. It programmatically triggers npm install for packages like @hyperframes/producer, @hyperframes/core, and sharp if they are not already available in the environment.
While the installer uses --ignore-scripts as a security measure, the skill immediately imports and executes the downloaded code via dynamic import(), allowing the execution of logic not contained within the original skill distribution.
[COMMAND_EXECUTION]:
scripts/package-loader.mjs invokes the npm binary through spawnSync to perform package installations.
references/design-picker.md instructs the agent to launch a local web server using python3 -m http.server to provide a design selection interface for the user.
scripts/extract-audio-data.py executes the ffmpeg CLI tool using subprocess.run to decode and extract data from media files.
[INDIRECT_PROMPT_INJECTION]:
Ingestion points: The skill processes user-supplied text (headlines and sublines) from the conversation prompt in the references/design-picker.md workflow.
Boundary markers: The design picker uses double-brace tokens (e.g., {{prompt_headline}}) to define where user content is interpolated into the templates/design-picker.html template.
Capability inventory: The agent writes the resulting HTML file to the local filesystem and serves it via a Python HTTP server, making it accessible through a browser.
Sanitization: There is no implemented sanitization or HTML escaping for the interpolated user strings. This creates a potential XSS vulnerability if a user provides malicious input designed to execute script when the picker is viewed.
[DYNAMIC_EXECUTION]: The dependency loader in scripts/package-loader.mjs uses dynamic import() on computed paths within temporary directories to load and run code fetched at runtime.
[EXTERNAL_DOWNLOADS]: The skill performs external network requests to download Node.js packages from the npm registry and font assets from Google Fonts services.

hyperframes-creative