The Agent Skills Directory

[COMMAND_EXECUTION]: The skill relies on external binaries (ffprobe, ffmpeg) and the Remotion CLI. In scripts/render.mjs, the final render command is built as a string by concatenating user-provided inputs such as the output path and browser executable path. This construction method lacks proper sanitization or escaping, which could allow an attacker to inject arbitrary shell commands if the agent passes unvalidated user input to these parameters. \n- [PRIVILEGE_ESCALATION]: The scripts/render-mv.sh script includes logic to detect missing CJK fonts and automatically attempts to install them using sudo apt-get. Although this is intended to support proper rendering of lyrics in container environments, it involves executing commands with elevated privileges and modifying the system-wide package state. \n- [DYNAMIC_EXECUTION]: The skill assembles a shell command string in scripts/render.mjs and executes it using execSync. It also uses shell arithmetic expansion in scripts/render-mv.sh on the --max-size parameter. Both patterns represent dynamic execution risks where malformed input could lead to unintended code execution. \n- [EXTERNAL_DOWNLOADS]: The skill performs downloads from established and well-known services. It may download the chrome-headless-shell binary from Google servers through the Remotion framework and fetches font packages from official Linux distribution repositories. These operations are functional requirements for the skill's stated purpose.

acestep-simplemv