The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes subprocess.run to invoke FFmpeg for video processing and audio merging. All such calls are implemented using argument lists rather than raw shell strings, which is a best practice that prevents shell injection vulnerabilities.
[CREDENTIALS_UNSAFE]: The skill relies on multiple API keys for external AI services. It follows secure development practices by instructing users to manage these secrets through environment variables or a .env file using the python-dotenv library, rather than hardcoding credentials in the scripts.
[EXTERNAL_DOWNLOADS]: The skill downloads generated media (images and videos) from official API endpoints of services like OpenAI, LumaAI, and Replicate. These downloads are central to the skill's purpose and are conducted over HTTPS to trusted service domains.
[INDIRECT_PROMPT_INJECTION]: The skill processes user-provided prompts by sending them to external AI generation APIs. While this creates a processing surface for untrusted text, the prompt content does not flow into sensitive local operations or shell commands, mitigating the risk of local execution through injection.

ai-video-gen