The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill downloads app screenshots and design metadata from Google Cloud Storage (storage.googleapis.com) using curl. This is a well-known, trusted service, and the assets are required for the primary function of video generation.
[COMMAND_EXECUTION]: Utilizes bash commands and standard Node.js tools (npm, npx) to initialize projects, manage dependencies, and render video files. These operations are standard for modern development and media production workflows.
[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface as it ingests untrusted data (screen titles, descriptions, and HTML) from external Stitch projects to generate video annotations. Ingestion occurs during screen metadata retrieval in SKILL.md Step 2. While there are no explicit boundary markers or sanitization steps mentioned for this data, the risk is inherent to the skill's primary purpose of design automation.
[SAFE]: No malicious patterns, obfuscation, persistence mechanisms, or unauthorized credential access were detected. The skill's behavior aligns with its documented purpose and is authored by a trusted entity (google-labs-code).

remotion