The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill documents patterns for fetching untrusted external data at runtime to calculate composition metadata, creating an attack surface for indirect prompt injection.
Ingestion points: Multiple files, including rules/calculate-metadata.md and rules/compositions.md, demonstrate fetching data from external URLs provided via props (e.g., props.dataUrl, props.videoId).
Boundary markers: The provided code examples lack boundary markers or specific instructions to the agent to treat the fetched data as potentially untrusted or to ignore embedded instructions.
Capability inventory: The skill focuses on video rendering, but uses the fetch API to retrieve remote content which is then used to dynamically set composition duration, dimensions, and other props.
Sanitization: No sanitization or validation logic is presented in the examples to ensure the integrity of the external data before it influences the agent's context or the rendering process.
[EXTERNAL_DOWNLOADS]: The skill provides instructions for installing various third-party packages and tools required for the Remotion ecosystem.
Evidence: The rule files frequently instruct the user to install packages like @remotion/*, mapbox-gl, zod, and @turf/turf. Additionally, rules/transcribe-captions.md provides a script for installing whisper.cpp. These are recognized as standard dependencies for the framework's features.

remotion-best-practices