The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/extract-audio-data.py executes the ffmpeg system command using subprocess.run to process audio data.
[REMOTE_CODE_EXECUTION]: The scripts/package-loader.mjs utility provides a mechanism to install Node.js packages at runtime via npm install. This is used to manage dependencies for media processing but represents a capability to download and execute external code.
[DYNAMIC_EXECUTION]: The skill uses dynamic module loading in scripts/package-loader.mjs, employing import() to load packages from paths resolved at runtime.
[EXTERNAL_DOWNLOADS]: Several HTML templates and presets reference the GSAP library from a well-known public CDN (cdn.jsdelivr.net) and fetch fonts from Google Fonts.
[INDIRECT_PROMPT_INJECTION]: The skill's workflows involve processing user prompts and external design specs which then influence script execution and file generation. This is a common pattern for AI agent skills but establishes an attack surface.
Ingestion points: User instructions in SKILL.md workflows and design tokens processed via references/design-spec.md.
Boundary markers: Absent in the provided files.
Capability inventory: Execution of shell commands (ffmpeg), package management (npm), dynamic script loading, and file system operations.
Sanitization: General instructions in references/design-picker.md advise against allowing script tags in generated HTML, but no automated sanitization is implemented in the provided utility scripts.

hyperframes-creative