The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The script scripts/coze_bot_client.py contains a hardcoded API key (cztei_qHZQ0A5OSJjsmfZWmVb8bqu2BTbtB240YGbDYLhZpsIr8jER4aL4Aevyii8rnKfNs) which is used as a fallback. This exposes service credentials within the skill source code.\n- [COMMAND_EXECUTION]: Multiple scripts, such as scripts/compose_video.py and scripts/generate_narration.py, use subprocess.run to execute ffmpeg commands for media processing. While necessary for the skill's functionality, this involves direct interaction with the system shell.\n- [EXTERNAL_DOWNLOADS]: The skill performs network requests to external APIs including api.coze.cn for visual analysis and api.edata.cloud for music generation. It also downloads image assets from s.coze.cn.\n- [REMOTE_CODE_EXECUTION]: In scripts/voice_generator.py, the skill dynamically modifies the Python sys.path to import a TTS generator from a relative path (../../temp_qwen3_tts/qwen3-tts-local/scripts) located outside the skill's root directory, which is a risky practice for loading code.\n- [DATA_EXFILTRATION]: The scripts/file_server.py utility starts an HTTP server on port 8080 to serve generated files from the output directory. This could potentially expose local files to the network without authentication.\n- [PROMPT_INJECTION]: The skill ingests untrusted user content and extracted video frames to generate prompts for AI models, creating a surface for indirect prompt injection.\n
Ingestion points: User instructions and video frames extracted via OpenCV in scripts/video_frame_extractor.py.\n
Boundary markers: Absent; user-controlled data is interpolated directly into system prompts for analysis and creation.\n
Capability inventory: The skill has the ability to execute shell commands (ffmpeg), write files to disk, and make network requests.\n
Sanitization: There is no evidence of sanitization or validation of the ingested external content before it is used in prompt construction.

video-creation-suite