The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes subprocess.run to call ffmpeg and ffprobe for media processing operations such as concatenation and audio mixing.
Evidence: Functions in scripts/compose_video.py (e.g., concatenate_simple, add_background_music) construct command lists for execution.
Mitigation: The implementation avoids using shell=True and passes arguments as lists, which effectively prevents shell command injection.
[INDIRECT_PROMPT_INJECTION]: The skill relies on an external script.json file to determine which video segments to process and what transitions to apply. This represents an attack surface where maliciously crafted script data could attempt to manipulate the video output or probe the filesystem.
Ingestion points: The compose_video function in scripts/compose_video.py loads scene data from a JSON file.
Boundary markers: The skill does not implement specific delimiters or warnings to ignore instructions embedded within the processed data.
Capability inventory: The skill performs file reading, filesystem existence checks, and calls external media processing binaries.
Sanitization: The script includes validation for transition types, mapping input strings to a safe internal set of xfade parameters, and verifies that video files exist before processing.

compose-video