The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The script scripts/merge_videos.py uses the eval() function on data derived from an external source.\n
Evidence: In get_video_info, the code executes eval(s.get('r_frame_rate', '30/1')). The variable s contains metadata extracted from a video file via ffprobe. An attacker could potentially craft a video file with a malicious Python expression in the frame rate metadata to achieve arbitrary code execution.\n- [COMMAND_EXECUTION]: The skill executes system commands to process video files.\n
Evidence: The script scripts/merge_videos.py makes multiple calls to subprocess.run to execute ffmpeg and ffprobe. While it uses the list-based argument passing method (which is safer than shell=True), it still provides a mechanism for the agent to interact with powerful system binaries.

video-merge-send