The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill references models and licenses hosted on HuggingFace by a well-known organization (Google), which is a common and legitimate practice for AI development tools.
[CREDENTIALS_UNSAFE]: The skill instructions promote secure practices by recommending the use of .env files for configuration and platform-native secret managers (such as Modal secrets) to store sensitive API tokens.
[COMMAND_EXECUTION]: The skill utilizes local scripts and standard utilities like ffmpeg to perform its primary video generation and processing functions, representing expected behavior for its stated use case.
[INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied prompts and images for video generation, which is a standard feature for this type of tool.
Ingestion points: User prompts via the --prompt argument and input images via the --input argument in SKILL.md.
Boundary markers: The instructions do not specify the use of delimiters to isolate user-controlled inputs within the command-line arguments.
Capability inventory: The skill interacts with the local file system and executes shell commands for inference and media processing.
Sanitization: Standard CLI argument passing is used; the documentation does not describe specific filtering for the content of user-supplied prompts.

ltx2