The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The script scripts/coze_bot_client.py contains a hardcoded API Key ('cztei_...') and Bot ID ('7572...') within its main function for calling the Coze API.
[DYNAMIC_EXECUTION]: scripts/voice_generator.py manipulates the Python search path using sys.path.append to include a location two levels above its own directory (../../temp_qwen3_tts/qwen3-tts-local/scripts). This is used to import the LocalTTSGenerator module, allowing for the execution of arbitrary code from potentially untrusted or unexpected locations on the host system.
[DATA_EXFILTRATION]: scripts/coze_bot_client.py reads local image frames, encodes them into Base64 format, and transmits them to the external domain api.coze.cn for visual analysis.
[EXTERNAL_DOWNLOADS]: scripts/sound_generator.py includes functionality to download audio files from remote URLs provided by the Suno API proxy service (api.edata.cloud) using requests.get.
[COMMAND_EXECUTION]: The SKILL.md frontmatter includes a system dependency instruction to run pip install -r requirements.txt, which executes package installation commands on the host.
[COMMAND_EXECUTION]: scripts/video_compositor.py executes a configuration change for the moviepy library that explicitly sets the path for the ImageMagick binary to /usr/bin/convert.
[DATA_EXFILTRATION]: scripts/file_server.py implements a directory-sharing HTTP server. While intended for downloading output, it can be directed to serve any local directory, potentially exposing sensitive files to the network.

video-recreation