The Agent Skills Directory

[COMMAND_EXECUTION]: The script youtube_factory.py utilizes subprocess.run to call ffmpeg, ffprobe, and edge-tts. These calls are implemented using argument lists rather than shell strings, which is a secure practice that prevents shell injection vulnerabilities. The inputs to these commands (file paths and text segments) are controlled or sanitized by the skill.
[EXTERNAL_DOWNLOADS]: The skill fetches video assets from Pexels. It implements a dedicated validate_stock_url function that verifies the domain and protocol of the download URL against a whitelist of known Pexels domains. This effectively mitigates Server-Side Request Forgery (SSRF) risks when downloading remote content.
[INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied topics and potentially LLM-generated script text to create video captions. While this constitutes an ingestion of untrusted data, the risk is minimized by basic text sanitization (stripping control characters) and the use of structured FFmpeg filter paths rather than raw shell interpolation. The capability to write files is restricted to the specific output directory and temporary system folders.

youtube-factory