The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from GitHub Pull Requests, including titles, bodies, and code diffs, which are used to generate video scripts and frame content. \n
Ingestion points: The scripts/fetch-pr.mjs script retrieves PR data using the GitHub CLI, which is then stored and processed by scripts/ingest.mjs. \n
Boundary markers: The instructions lack explicit delimitation or warnings to ignore embedded instructions within the PR data. \n
Capability inventory: The skill has the ability to execute shell commands (gh, npx), write files to the project directory, and dispatch sub-agents for complex tasks. \n
Sanitization: scripts/ingest.mjs performs basic cleaning (stripping HTML comments and truncation), and scripts/captions.mjs implements some character escaping, but these measures do not fully prevent adversarial content from influencing the agent's behavior. \n- [EXTERNAL_DOWNLOADS]: The skill retrieves external data and code during its operation. \n
Evidence: scripts/fetch-pr.mjs fetches PR metadata and diffs from GitHub. scripts/fetch-people-avatars.mjs downloads contributor avatars from github.com and *.githubusercontent.com. Additionally, npx hyperframes add is used to install visual blocks from an external registry. \n
Note: These operations target GitHub and the developer's official registry, which are trusted or well-known services. \n- [DYNAMIC_EXECUTION]: The skill generates and modifies executable HTML and JavaScript at runtime to produce video compositions. \n
Evidence: scripts/captions.mjs dynamically builds a sub-composition containing JavaScript for managing caption timing, and scripts/transitions.mjs injects GSAP animation code directly into the index.html file. \n
Note: This is an expected and necessary behavior for the skill's purpose of generating programmatic video content. \n- [COMMAND_EXECUTION]: The skill executes system-level commands to interact with external tools. \n
Evidence: Multiple scripts and instructions utilize execFileSync or spawnSync to run the gh (GitHub CLI), npx, ffmpeg, and ffprobe utilities.

pr-to-video