The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted data from external websites provided by the user during the capture phase.
Ingestion points: Data enters the agent's context through captured site text (visible-text.txt) and asset descriptions (asset-descriptions.md) as described in references/step-0-capture.md and references/step-2-brief.md.
Boundary markers: The skill instructions do not explicitly define boundary markers or 'ignore' instructions for the captured data, relying on the agent's ability to categorize it as brand context.
Capability inventory: The skill utilizes curl for network communication, npx for executing framework tools, and has full file-system write access to build compositions.
Sanitization: There is no mention of sanitizing or escaping the captured website content before it is used to generate the video script.
[COMMAND_EXECUTION]: The skill workflow requires the agent to execute multiple CLI commands, including npx hyperframes (for capture, linting, and rendering), curl (for interacting with TTS APIs like ElevenLabs and HeyGen), and node (for running verification scripts like w2h-verify.mjs).
[EXTERNAL_DOWNLOADS]: The skill interacts with well-known services and CDNs. It references libraries such as GSAP, Three.js, and Anime.js from cdn.jsdelivr.net within generated HTML files. It also fetches audio and metadata from HeyGen and ElevenLabs APIs. These sources are considered well-known and professional service providers.
[DYNAMIC_EXECUTION]: The skill generates and executes HTML and JavaScript files (compositions) at runtime. These files utilize animation engines and custom scripts to render video frames. This dynamic generation is the core intended purpose of the skill.

website-to-video