The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill's documentation provides instructions to install the heygen CLI utility via a curl | bash command from https://static.heygen.ai/cli/install.sh. This URL represents the official distribution point for the well-known HeyGen AI platform.- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted natural language via the --intent parameter and reads project-level design specification files (e.g., frame.md). These inputs influence search queries sent to external media providers. The skill has capabilities to perform network requests and write to the file system.
Ingestion points: --intent parameter in scripts/resolve.mjs; frame.md, design.md, and DESIGN.md in scripts/lib/brand-provider.mjs.
Boundary markers: None present in the data interpolation flow.
Capability inventory: Subprocess execution via execFileSync (heygen, ffprobe), network operations via fetch, and file writes via writeFileSync and copyFileSync.
Sanitization: Command execution uses argument arrays to prevent shell injection, and a MAX_FREEZE_BYTES limit of 256MB is enforced on downloads to prevent resource exhaustion.- [COMMAND_EXECUTION]: The skill uses the heygen and ffprobe binaries to search catalogs and extract media metadata. The implementation utilizes execFileSync with literal argument arrays rather than shell strings, which effectively mitigates command injection risks from user-supplied inputs or file paths.

media-use