The Agent Skills Directory

[COMMAND_EXECUTION]: The skill invokes system utilities ffmpeg and ffprobe via Python's subprocess module to perform media format conversion and analysis. These calls are implemented using argument lists to avoid shell injection, and all input paths are restricted by a path confinement utility to prevent traversal attacks. Evidence found in scripts/animate_anyone.py, scripts/image_to_video.py, and scripts/live_portrait.py.
[EXTERNAL_DOWNLOADS]: The skill downloads AI-generated media (videos, images, audio) from Alibaba Cloud's DashScope and LingMou APIs. It also requires several official Alibaba Cloud SDKs (dashscope, oss2, alibabacloud-lingmou20250527). These downloads are consistent with the skill's primary purpose and target trusted vendor domains.
[INDIRECT_PROMPT_INJECTION]: The skill provides an interface for processing user-supplied text to generate speech and video content, creating a potential injection surface. 1. Ingestion points: Untrusted text enters via command-line arguments and files in scripts/qwen_tts.py, scripts/avatar_video.py, scripts/image_to_video.py, and scripts/text_to_image.py. 2. Boundary markers: No specific delimiters or warnings are used to wrap user input before it is sent to the AI APIs. 3. Capability inventory: The skill possesses capabilities to execute subprocesses (ffmpeg), perform network operations (Alibaba Cloud APIs, OSS uploads), and write files to the local disk. 4. Sanitization: The skill employs a dedicated input_validation.py script to enforce path confinement and validate URLs, but does not sanitize the natural language content of the prompts/scripts.

alibabacloud-avatar-video