The Agent Skills Directory

[DYNAMIC_EXECUTION]: The script scripts/package-loader.mjs is designed to dynamically resolve and import Node.js packages. It uses the import() function to load modules from computed file paths after they are installed.
[REMOTE_CODE_EXECUTION]: scripts/package-loader.mjs includes a bootstrapping mechanism that executes npm install to fetch dependencies like sharp and @hyperframes/producer into a temporary directory if they are not already present in the environment.
[INDIRECT_PROMPT_INJECTION]: The templates/design-picker.html template renders user-influenced HTML using innerHTML without technical sanitization. While references/design-picker.md instructs the AI agent to avoid including scripts or event handlers in these previews, there is no programmatic sanitization or Content Security Policy (CSP) to enforce this, creating a surface for cross-site scripting (XSS) if the generated HTML is malicious. * Ingestion points: templates/design-picker.html (via JSON placeholders). * Boundary markers: Absent in the template code; instructions exist in references/design-picker.md. * Capability inventory: Browser-based preview rendering with GSAP support. * Sanitization: Absent in the template logic.
[COMMAND_EXECUTION]: scripts/extract-audio-data.py uses the subprocess.run function to invoke the ffmpeg command-line tool. This is used for decoding audio data for visualization and does not appear to use a shell or allow arbitrary command injection.
[EXTERNAL_DOWNLOADS]: Several HTML files, including templates/design-picker.html and various showcase files, fetch the GSAP library and Google Fonts from well-known content delivery networks (cdn.jsdelivr.net and fonts.googleapis.com).

hyperframes-creative