The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The script scripts/coze_bot_client.py contains a hardcoded default API key (cztei_qHZQ0A5OSJjsmfZWmVb8bqu2BTbtB240YGbDYLhZpsIr8jER4aL4Aevyii8rnKfNs) and Bot ID (7572557757883383858). Hardcoding secrets in source code is a high-risk practice as it allows unauthorized access to the associated services if the skill files are shared or inspected.
[INDIRECT_PROMPT_INJECTION]: The skill features a "Video Recreation" mode that processes frames from external videos to generate new scripts and prompts. Scripts like scripts/visual_analyzer.py and scripts/coze_bot_client.py ingest this untrusted visual data. Adversarial content embedded in video frames (such as text instructions) could manipulate the agent's content generation logic or downstream tool usage.
[COMMAND_EXECUTION]: Several scripts, including scripts/compose_video.py, scripts/generate_background_music.py, and scripts/generate_narration.py, utilize subprocess.run() to invoke the ffmpeg utility. While necessary for the skill's primary function, this pattern requires strict validation of all input parameters and file paths derived from user-provided scripts to prevent command injection.
[COMMAND_EXECUTION]: The scripts/file_server.py utility starts an HTTP server listening on 0.0.0.0. By binding to all network interfaces, the server makes the generated files in the ./output directory accessible to any device on the same local network, posing a risk of unauthorized data exposure.
[COMMAND_EXECUTION]: scripts/voice_generator.py attempts to dynamically modify the Python path using sys.path.append to import a local TTS generator from a relative directory structure (../../temp_qwen3_tts/...). This dependency on external, relative paths can lead to unpredictable code execution depending on the host environment's file layout.

video-creation-suite