The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/generate.sh generates shell scripts by interpolating metadata extracted from external files (such as SKILL.md and agent definitions) using unquoted heredocs. Variables like ${DEMO_NAME}, ${DEMO_DESCRIPTION}, and ${PHASES} are written directly into generated bash scripts. A malicious source file containing command substitution payloads (e.g., $(touch /tmp/pwned)) in these fields would cause the commands to be executed when the generated script is run by the vhs tool.
[DYNAMIC_EXECUTION]: The core functionality of the skill involves dynamically generating executable bash scripts and VHS configuration files (.tape) at runtime based on parsed inputs from other files in the project. These generated assets are subsequently executed to facilitate the video production pipeline.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from skill and agent markdown files to drive its script generation process. It lacks robust sanitization and boundary markers in scripts/generate.sh, allowing malicious content in those source files to escape the intended string context and execute in the shell. Ingestion points include the metadata extraction functions in scripts/generate.sh, while capabilities include full Bash execution, file writing, and tool invocation. Sanitization is only partially implemented for the cli content type via printf %q, leaving other types vulnerable.
[DATA_EXFILTRATION]: The skill implements a --live mode that utilizes Tailscale Funnel (portless --funnel) to expose the development stack via a public URL. While this is an intended feature for sharing demos, it creates a significant security surface for the accidental exposure of private code, credentials, or environment details to the public internet.

demo-producer