The Agent Skills Directory

EXTERNAL_DOWNLOADS (MEDIUM): The skill instructs the agent to download and install external binaries and packages from the Remotion ecosystem. Specifically, it uses the @remotion/install-whisper-cpp package to download the Whisper.cpp binary.
Evidence: Found in rules/transcribe-captions.md where installWhisperCpp is called to fetch and install version 1.5.5 of the binary.
COMMAND_EXECUTION (MEDIUM): The skill provides specific shell commands for the agent to run, including complex media processing commands using bunx and node.
Evidence: rules/ffmpeg.md contains literal command line instructions for trimming videos using bunx remotion ffmpeg. rules/voiceover.md instructs running a generation script with environment file flags.
REMOTE_CODE_EXECUTION (MEDIUM): In rules/tailwind.md, the skill explicitly tells the agent to fetch instructions from an external URL (remotion.dev/docs/tailwind) using WebFetch. This creates a vector where instructions are loaded dynamically from an unverified external source.
INDIRECT_PROMPT_INJECTION (LOW): The skill establishes several surfaces for indirect prompt injection by fetching and processing external JSON data (API responses, caption files) without explicit sanitization or boundary markers.
Ingestion points: rules/calculate-metadata.md (fetches from props.dataUrl), rules/compositions.md (fetches from api.example.com), and rules/display-captions.md (fetches JSON from public assets).
Boundary markers: Absent in all fetching logic.
Capability inventory: High-capability operations like shell command execution (bunx) and binary execution (whisper.cpp) are available to be influenced by this data.
Sanitization: No evidence of data validation or escaping before use in the rendering pipeline.

remotion-best-practices