The Agent Skills Directory

[COMMAND_EXECUTION]: The skill makes extensive use of the shell to orchestrate the motion graphics pipeline. It executes npx hyperframes, ffmpeg, ffprobe, and various Node.js scripts (resolve.mjs, bake-basemap.mjs, locate.mjs) to initialize projects, probe media, and render video files.
[EXTERNAL_DOWNLOADS]: The skill downloads runtime libraries and assets from several external sources:
Fetches gsap, maplibre-gl, topojson-client, and world-atlas from Cloudflare's well-known JSDelivr CDN service.
Retrieves map tiles from arcgisonline.com and cartocdn.com for basemap rendering.
Captures external content from user-provided URLs for the webpage, news, and tweet categories.
[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests untrusted data from external websites, tweets, and news articles. While this data is structured into a shot-plan.json intermediate representation, the final HTML/JS compositions are generated by subagents incorporating this content without explicit sanitization, potentially allowing malicious content in the source data to influence the agent's behavior during the build phase.
Ingestion points: Data enters the context via the webpage, news, and tweet categories using search or capture tools in SKILL.md and phases/source/guide.md.
Boundary markers: The skill uses a structured JSON intermediate representation (shot-plan.json) to pass information between planning and building phases.
Capability inventory: The skill can write files (compositions/index.html) and execute shell commands (ffmpeg, npx hyperframes) as detailed in agents/builder.md.
Sanitization: There is no evidence of HTML escaping or input validation for the external content before it is embedded in the composition templates.
[DYNAMIC_EXECUTION]: The skill employs dynamic execution patterns for its core rendering functionality:
categories/maps/bake-basemap.mjs uses Puppeteer to render a local HTML template that executes external scripts to generate map frames.
The Builder subagent (agents/builder.md) dynamically generates the index.html source for the video composition based on the shot plan.
[PRIVILEGE_ESCALATION]: The categories/maps/bake-basemap.mjs script launches the Puppeteer browser instance with the --no-sandbox argument. This disables the browser's security sandbox, which is intended to isolate the browser process from the host system. While used here for rendering a specific local template, this remains a best-practice violation for browser automation.

motion-graphics