The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/frame.sh is vulnerable to shell command injection.
The script parses command-line arguments and assigns them to variables such as index, time, and out.
These variables are subsequently interpolated into an ffmpeg command string within double quotes, for example: ffmpeg ... -vf "select=eq(n\\,${index})" ... "$out".
Because the variables are expanded by the shell before the command is executed, a crafted input (e.g., --index '0"; touch /tmp/pwned #') would allow an attacker to escape the double-quoted context and execute arbitrary bash commands.
Additionally, the out variable is used in mkdir -p "$(dirname "$out")", which could be exploited to create arbitrary directories or perform additional injection if the path contains shell metacharacters.
[EXTERNAL_DOWNLOADS]: The skill configuration in SKILL.md describes the installation of the ffmpeg utility via the Homebrew package manager (brew). This is a common method for managing binary dependencies on supported systems.

video-frames