The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill generates React-based Remotion components (WalkthroughComposition.tsx, ScreenSlide.tsx) and configuration files at runtime. These generated components are then compiled and executed by the Remotion engine to render the final MP4 video.
[EXTERNAL_DOWNLOADS]: Fetches design assets, including screenshots and metadata, from Google Cloud Storage (storage.googleapis.com). These downloads are integral to the skill's primary function of converting designs to video assets and target well-known, trusted infrastructure.
[COMMAND_EXECUTION]: Utilizes shell commands via the Bash tool to initialize Node.js projects, install official Remotion dependencies (@remotion/transitions), and execute the video rendering CLI commands. It also uses a helper script (scripts/download-stitch-asset.sh) to manage asset retrieval with curl.
[INDIRECT_PROMPT_INJECTION]: The skill ingests external data from the Stitch API (screen titles, descriptions) which are interpolated into the video as text overlays. While this presents an attack surface where malicious text in the design could influence the video content, it is handled within the context of React component rendering.
Ingestion points: Project metadata and screen details retrieved via stitch:list_screens and stitch:get_screen stored in screens.json.
Boundary markers: None explicitly implemented in the template files to distinguish between trusted instructions and design metadata.
Capability inventory: Includes file writing, shell execution for project setup, and video rendering via the Remotion CLI.
Sanitization: Uses standard React JSX interpolation for text overlays in ScreenSlide.tsx, providing default protection against typical script injection in the UI context.

remotion