The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The documentation in workflow.md identifies data/config.json as the storage location for sensitive API keys, including anthropicKey and googleApiKey. Given the skill's Read permissions, this identifies a path for potential credential exposure.
[PROMPT_INJECTION]: Indirect injection surface detected. 1. Ingestion points: The concept argument in generate_structure (SKILL.md, workflow.md). 2. Boundary markers: Absent. 3. Capability inventory: Read and Write permissions along with various video generation/assembly tool calls. 4. Sanitization: Absent.
[COMMAND_EXECUTION]: The workflow.md file contains several curl commands intended for use with a local server (http://localhost:3000). These define the interaction patterns used to drive the production pipeline.

produce-video