The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/download_video.py uses subprocess.run to execute ffmpeg and ffprobe for metadata extraction and frame generation. While arguments are passed as a list to mitigate shell injection, the skill relies on executing external system binaries to process user-provided video files.
[EXTERNAL_DOWNLOADS]: The script scripts/download_video.py contains a mechanism to dynamically install the requests Python package at runtime using pip if it is not already present in the environment.
[PRIVILEGE_ESCALATION]: The SKILL.md file provides specific instructions for the user or agent to run sudo apt-get install ffmpeg to fulfill the skill's requirements. Instructions to use sudo are flagged as they encourage elevated permission usage.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted video data from external URLs.
Ingestion points: Video data is fetched via requests.get in scripts/download_video.py.
Boundary markers: None present; there are no instructions to the agent to disregard potential instructions embedded in video metadata or visual frames.
Capability inventory: The script can perform network downloads, file system writes (/mnt/user-data/outputs), and execute system commands via subprocess.
Sanitization: Shell injection is mitigated by using list-based arguments for subprocess.run, but the content of the video (frames/metadata) is intended for agent analysis, creating a surface for indirect influence.

video-viewing