The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is instructed to inspect project manifests and lockfiles to identify package managers and workspaces. This represents an ingestion point for untrusted data that could be used to influence the agent's behavior if the project files contain malicious content.
Ingestion points: Step 1 in SKILL.md (Inspect the project manifests and lockfile).
Boundary markers: Not explicitly defined in the instructions.
Capability inventory: The skill has the ability to execute shell commands (npx), write to the filesystem (updating dependencies/lockfiles), and make network requests (npm registry queries).
Sanitization: No specific validation or sanitization steps are defined for the content read from manifests.
[COMMAND_EXECUTION]: The skill uses npx to execute the Remotion CLI (npx remotion upgrade) and update project-local skills (npx skills update). These commands execute code within the user's environment to perform the upgrades.
[EXTERNAL_DOWNLOADS]: The skill queries the official npm registry using npm view to retrieve version metadata for remotion, @remotion/studio, and auxiliary packages like mediabunny and @huggingface/transformers. This is standard behavior for package management tasks.

remotion-upgrade