The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes subprocess.run in several workflows to execute external CLI tools, including whisper for transcription, python3 for internal scripts, and npx hyperframes for video rendering. While these are used for intended features like captioning, executing shell commands with parameters derived from file paths and user variables presents a risk of command injection if inputs are not strictly validated.
[EXTERNAL_DOWNLOADS]: The skill facilitates the download of its core logic from a external GitHub repository and relies on third-party dependencies from standard registries, such as openai-whisper via pip and hyperframes via npx. These tools are downloaded and executed locally to process video and image assets.
[PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection. It interpolates user-provided text—such as product names, competitor names, and dialogue scripts—directly into prompts sent to various AI models (Seedance, Veo, Sora, Nano Banana). There are no explicit boundary markers or sanitization steps mentioned to prevent embedded instructions in user data from influencing the agent's behavior or bypassing intended generation constraints.
[DATA_EXFILTRATION]: The skill transmits data, including Base64-encoded image frames and prompt text, to the vendor's API at api.arcads.ai. This is consistent with the skill's stated purpose of leveraging cloud-based AI generation services.

arcads-video-agent