The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The installation process involves cloning a repository from GitHub and executing a shell script (./scripts/setup.sh). This allows for arbitrary code execution from a remote source during the setup phase.
[COMMAND_EXECUTION]: The skill instructs the agent to invoke several shell and Python scripts (e.g., generate.sh, add_captions.sh, publish.py) located within the cloned repository to perform core functions.
[EXTERNAL_DOWNLOADS]: The skill initiates a download of a complete codebase from an external GitHub repository (https://github.com/krusemediallc/arcads-claude-code.git) and uses pip to install requirements from that codebase.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection by interpolating untrusted user data (such as product names, competitor names, and dialogue scripts) directly into prompts for image and video generation models.
Ingestion points: User-provided values for product_name, competitor_name, dialogue_script, and character_description in SKILL.md.
Boundary markers: Absent; user input is embedded directly into f-string templates without delimiters or 'ignore' instructions.
Capability inventory: The skill can execute shell commands (git, pip, brew, apt, and repository-specific scripts), write to files (like .env and MASTER_CONTEXT.md), and perform network operations via requests to api.arcads.ai.
Sanitization: No validation or escaping of external content is implemented before interpolation into generation prompts.

arcads-ai-video-generator