The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The installation process instructs the user to clone a repository from a third-party GitHub organization (krusemediallc/arcads-claude-code.git) and run a shell script (setup.sh). This pattern facilitates the execution of arbitrary remote code during the skill's setup phase.
[COMMAND_EXECUTION]: The skill utilizes subprocess.run to execute system tools like ffmpeg for video processing and npx hyperframes for captioning. It also executes internal Python scripts (upload_image.py, create_ad.py) to manage ad publishing. These actions involve shell execution based on files generated or downloaded by the skill.
[EXTERNAL_DOWNLOADS]: The skill programmatically downloads video and image content from the Arcads API using requests.get and saves it to the local filesystem (e.g., temp/beat_{i+1}.mp4). This data is subsequently processed by media tools like ffmpeg, creating a data flow from a remote service to system-level commands.
[PROMPT_INJECTION]: The skill processes untrusted user inputs (such as product names, brand descriptions, and ad copy) and interpolates them directly into prompts for external AI models (gpt-image-2, seedance-2) without sanitization, creating a surface for indirect prompt injection.
Ingestion points: User-provided strings are captured via function arguments in generate_apple_notes_ad, create_influencer, and other video generation payloads.
Boundary markers: The skill does not use delimiters or explicit instructions to prevent the model from executing commands embedded within the user-supplied data.
Capability inventory: The skill has the ability to write files, make network requests, and execute subprocesses.
Sanitization: No validation or escaping is applied to user-supplied text before it is inserted into the final prompt templates.

arcads-ai-video-agent