The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The setup process involves downloading external browser binaries via playwright install chromium to support screen recording features.
[REMOTE_CODE_EXECUTION]: The documentation encourages users to install additional agent skills from the Remotion ecosystem using npx skills i remotion-dev/skills/skills/remotion, which introduces new logic and capabilities into the agent environment from a remote registry.
[COMMAND_EXECUTION]: The skill makes extensive use of the shell to run various Python utilities and Node.js commands for asset searching, screen recording, voiceover generation, and video rendering (e.g., python3 tools/pexels_search.py, npx remotion render).
[DATA_EXFILTRATION]: The screen_record.py tool uses Playwright to navigate to arbitrary URLs provided in the configuration. This capability could be used to capture and export visual data from internal or sensitive web applications if a user-provided URL points to such a service.
[PROMPT_INJECTION]:
Ingestion points: The skill processes potentially untrusted data from multiple sources, including external URLs (via screen recording), product briefs in ad-config.ts, brand assets in brand.json, and bulk data from variants.csv.
Boundary markers: There are no explicit instructions or delimiters used when interpolating this external data into the prompts or configurations that drive the AI's composition logic.
Capability inventory: The skill possesses the ability to execute shell commands, write to the filesystem, and perform network requests (via Pexels API and Modal endpoints).
Sanitization: While the screen recording tool mentions blurring PII via CSS injection, there is no evidence of sanitization or validation for the text data ingested from CSVs or brand configurations before they are processed by the agent.

ad-video