The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses the Bash tool to execute ffmpeg and ffprobe commands, as well as local shell scripts (scripts/preflight.sh and scripts/detect_gpu.sh). While these are necessary for the skill's functionality, shell execution of scripts is a high-privilege operation.
[DYNAMIC_EXECUTION]: The instructions demonstrate the interpolation of user-supplied variables $INPUT and $OUTPUT directly into shell command strings. While the examples use double quotes, this pattern remains a command injection surface if the AI agent or platform does not sufficiently sanitize file paths that might contain shell metacharacters.
[INDIRECT_PROMPT_INJECTION]: The skill reads and analyzes metadata from external, potentially untrusted video files to determine encoding parameters.
Ingestion points: The $INPUT file is processed by ffprobe to extract width, height, and frame rate metadata in JSON format.
Boundary markers: None identified; the JSON output is directly consumed by the agent without explicit instructions to disregard potentially malicious data embedded in the file's metadata streams.
Capability inventory: The skill has access to the Bash and Read tools, enabling it to perform file system operations and execute complex command sequences.
Sanitization: There is no documented validation or sanitization of the input file's properties before they are used to compute export settings.

claude-video-export