The Agent Skills Directory

[COMMAND_EXECUTION]: The skill constructs and executes shell commands using the astria video CLI tool. User-controlled content is interpolated into command arguments, specifically the --video-prompt and --image-reference flags. Although this is the skill's intended function, the lack of escaping instructions poses a security risk if the agent does not properly handle shell metacharacters in the generated storyboard text.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a vulnerability surface for indirect prompt injection due to the following evidence chain:
Ingestion points: The skill reads image_prompt, reference tokens, and image_reference_urls from the current draft context (SKILL.md).
Boundary markers: There are no explicit boundary markers or instructions to treat user-supplied content as data rather than instructions when interpolating it into the video_prompt or shell commands.
Capability inventory: The skill has the capability to execute shell commands (astria video) and perform network operations via the vendor's API through present_generation (SKILL.md).
Sanitization: No sanitization, validation, or escaping logic is defined for the user-supplied content before it is used in the command-line execution or prompt generation.

storyboard