The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/bangumi_frames.py executes yt-dlp and ffmpeg via the subprocess module. These calls are implemented using argument lists rather than shell strings, which prevents command injection vulnerabilities from untrusted input strings.
[EXTERNAL_DOWNLOADS]: The skill fetches AI models and weights from well-known repositories (HuggingFace and GitHub) through its dependencies, dghs-imgutils and simple-lama-inpainting. These are standard sources for the tool's anime detection and inpainting capabilities.
[CREDENTIALS_UNSAFE]: The main script is configured to resolve Bilibili session cookies from a specific local path (~/bb_up/bb_cookies/www.bilibili.com_cookies.txt). This access is documented as a requirement for high-resolution content retrieval and is standard behavior for yt-dlp based tools.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data (Bilibili videos and images). Ingestion points: The input argument and yt-dlp downloads in scripts/bangumi_frames.py. Boundary markers: The script uses regex (re.sub(r"\W+", "_", ...)) to sanitize video IDs used in path construction and uses list-based subprocess calls. Capability inventory: Includes file writing (crops/, scenery/, detect.json), network downloads (yt-dlp), and media processing (ffmpeg, opencv, PIL). Sanitization: External IDs are sanitized before being used in file system operations to prevent directory traversal.

bangumi-frames