The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the user to install the narrator-ai-cli package directly from a GitHub repository (NarratorAI-Studio/narrator-ai-cli) that is not recognized as a trusted source.
[DATA_EXFILTRATION]: The documentation provides an example for setting a custom API endpoint using the domain https://custom-endpoint.com. This domain has been explicitly flagged as malicious by automated URL scanners, presenting a significant risk if an agent is configured to send data to this endpoint.
[COMMAND_EXECUTION]: The skill's primary functionality is built around executing system commands through subprocess.run to interact with the narrator-ai-cli tool. While it uses list-formatted arguments, the broad capability to execute CLI tools based on external input increases the attack surface.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection (Category 8) because it processes untrusted data from search results and external script generation APIs.
Ingestion points: Data enters the context via movie search and script generate commands in SKILL.md.
Boundary markers: No delimiters or warnings are used to protect the agent from instructions embedded in the movie titles or generated scripts.
Capability inventory: Uses subprocess.run across multiple functions to execute CLI commands with interpolated data.
Sanitization: The code parses JSON output but lacks validation or sanitization of the content before passing it as arguments to subsequent shell commands.

narrator-ai-cli-video-generation