The Agent Skills Directory

[COMMAND_EXECUTION]: The shell wrapper scripts/render_html_video.sh executes several system utilities including node, python3, ffprobe, and ffmpeg. It also invokes a verification script from a sibling directory (../z-wanghong-handwritten-ppt/scripts/check_deck.py) to validate input HTML content.
[COMMAND_EXECUTION]: The Node.js rendering script scripts/render_html_video.mjs uses spawnSync to locate system binaries (via which) and spawn to pipe raw frame data into an ffmpeg process for H.264 video encoding.
[EXTERNAL_DOWNLOADS]: The skill requires the installation of the puppeteer-core package (version 25.5.0) and its dependencies from the NPM registry to provide headless browser capabilities.
[COMMAND_EXECUTION]: The skill launches a headless browser instance with --allow-file-access-from-files and --no-sandbox flags. While these are necessary for rendering local HTML files and associated assets (like custom fonts), they represent an increased attack surface if the input HTML were to contain malicious scripts.
[DATA_EXFILTRATION]: The skill implements an indirect prompt injection surface by ingesting and rendering untrusted HTML files. However, this is mitigated by a mandatory pre-rendering check using check_deck.py, and the output is limited to a visual media format (MP4/PNG) without returning data to the model's text context.

z-wanghong-handwritten-video