The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill uses npx agent-media@latest to run code directly from the NPM registry. This executes the most recent version of the package without version pinning, which could lead to the execution of malicious code if the package is compromised.
[COMMAND_EXECUTION]: The instructions require the agent to execute shell commands to perform media extraction. The use of shell commands with user-supplied paths (--in <path>) could be vulnerable to command injection if inputs are not properly escaped.
[EXTERNAL_DOWNLOADS]: The tool downloads the agent-media package from a remote registry and can fetch video files from user-supplied URLs.
[INDIRECT_PROMPT_INJECTION]: The --in parameter accepts URLs and file paths, exposing the skill to untrusted data that could exploit vulnerabilities in the media processing logic.
Ingestion points: Input paths and URLs via the --in argument.
Boundary markers: None present in the instructions.
Capability inventory: Shell command execution and network file retrieval.
Sanitization: No specific input validation or sanitization steps are defined.
[PRIVILEGE_ESCALATION]: The documentation suggests installing the package globally using npm install -g, which typically requires administrative or root privileges.

audio-extract