The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The workflow executes npx hyperframes, which downloads and runs a CLI tool from the npm registry. This package originates from a non-trusted source and represents a third-party dependency executed at runtime.
[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection through its ingestion of untrusted video transcripts. Malicious instructions embedded in the transcript could potentially influence the agent's card design process.
Ingestion points: The transcript.json file, generated from user-provided audio, is used by the agent to design overlay cards (SKILL.md, Step 4 and 5).
Boundary markers: There are no explicit delimiters or instructions for the agent to ignore potentially malicious content within the transcript data.
Capability inventory: The agent has access to ffmpeg, ffprobe, and the hyperframes CLI, which executes generated HTML/JS in a headless browser.
Sanitization: The skill includes a 'Hard Rule' and linting process in Step 8 that prohibits <script> tags and external URLs in the generated card HTML, reducing the risk of malicious script execution.
[DYNAMIC_EXECUTION]: The agent dynamically generates HTML fragments and GSAP animation sequences based on the transcript content. This generated code is executed within a browser-based rendering engine to produce the final video output.
[COMMAND_EXECUTION]: The skill uses system commands including ffmpeg and ffprobe to process media files and npx to manage and run the rendering toolchain.

graphic-overlays