The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to fetch and process data from external, untrusted sources such as web pages, news articles, and social media posts (Tweets). This creates a surface for indirect prompt injection if the ingested content contains malicious instructions that could influence the agent's behavior during the motion graphic design or building phases.
Ingestion points: External content is fetched and processed in the webpage, news, and tweet categories as defined in their respective module files.
Capability inventory: The skill can execute shell commands via npx, ffmpeg, and node, and it has the authority to write configuration and media files to the project workspace.
Boundary markers: The provided instructions do not specify the use of delimiters or 'ignore' instructions to isolate untrusted external content from the agent's core instructions.
Sanitization: No explicit sanitization or filtering of fetched text content is mandated before it is used by the agent to generate code or designs.
[EXTERNAL_DOWNLOADS]: The skill downloads and executes standard JavaScript libraries (MapLibre, TopoJSON, GSAP) and geographic data from cdn.jsdelivr.net. These are well-known services for serving NPM packages, and the skill uses specific, pinned versions for its dependencies.
[DYNAMIC_EXECUTION]: The map baking process in categories/maps/bake-basemap.mjs uses puppeteer to dynamically generate and execute a headless browser environment. This environment executes both local logic and remote JavaScript libraries to render imagery. The browser is launched with the --no-sandbox flag, which is common in restricted environments but reduces the process isolation security.
[COMMAND_EXECUTION]: The workflow relies on standard command-line tools including ffmpeg, ffprobe, npx, and node to manipulate media, lint HTML compositions, and run utility scripts. These tools are used for their standard functions in a media production context.

motion-graphics