The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes media files by interpolating filenames and paths into shell commands for FFmpeg and ImageMagick. This creates an attack surface where maliciously crafted filenames could potentially lead to command injection if the agent does not perform adequate sanitization. Evidence: Ingestion points include file paths in commands across all documentation; Boundary markers: none; Capability inventory: FFmpeg and ImageMagick shell execution; Sanitization: none.
[COMMAND_EXECUTION]: The primary function of the skill is to provide instructions and examples for executing external command-line interface tools including ffmpeg, ffprobe, magick, convert, and mogrify. While this is the intended use case, it requires the agent to have shell execution capabilities.
[PRIVILEGE_ESCALATION]: The skill documentation includes instructions for using 'sudo' to perform administrative tasks, such as installing packages via 'apt-get' and modifying the ImageMagick 'policy.xml' security configuration file. These are standard procedures for the setup and maintenance of these tools.
[DYNAMIC_EXECUTION]: In the batch processing reference documentation, a shell script example includes the use of 'eval' to execute dynamically constructed commands during a dry-run phase to simulate operations.
[SAFE]: The installation section provides links to official and well-known domains for FFmpeg and ImageMagick, and uses standard package managers (Homebrew, apt, winget).

media-processing