The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill uses playwright to automate a headless browser for rendering and verifying local HTML designs and for exporting animations to video. This is seen in huashu-design/scripts/render-video.js, render-video-seek.js, and verify.py.
[COMMAND_EXECUTION]: Multiple shell and Node scripts execute system commands. For example, huashu-design/scripts/add-music.sh and mix-voiceover.sh use ffmpeg and ffprobe to process media files. huashu-design/scripts/narrate-pipeline.mjs uses execFileSync to run other local scripts.
[EXTERNAL_DOWNLOADS]: The skill interacts with external services to fetch assets for design tasks. huashu-design/scripts/fetch_images.py downloads images from Wikimedia Commons, and huashu-design/scripts/tts-doubao.mjs sends text to a ByteDance-hosted TTS API. These operations are documented as intended features for media fetching and synthesis.
[DATA_EXFILTRATION]: Verification and rendering scripts (verify.py, render-video.js) use the file:// protocol in Playwright. If the HTML being processed is sourced from an untrusted party, there is a theoretical risk that malicious JavaScript could attempt to read local files during the automated rendering process.
[PROMPT_INJECTION]: The skill ingests data from external sources such as brand specifications and web search results. While it includes extensive rules for "Anti-AI Slop," it lacks explicit boundary markers when interpolating untrusted content into its design engines, creating a surface for indirect injection.

design-studio