The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The shell scripts remove-background.sh and batch-remove-background.sh are designed to automatically install the rmbg-cli package from the NPM registry if it is missing from the system. Additionally, the RMBG tool is documented to download AI models from unpkg.com during its initial run. Both NPM and unpkg are recognized well-known services.
[COMMAND_EXECUTION]: The skill uses Python's subprocess.run and shell scripts to execute media operations using binaries like FFmpeg and ImageMagick. The Python scripts utilize list-based argument passing for these calls, which prevents shell injection vulnerabilities.
[INDIRECT_PROMPT_INJECTION]: As a media processing utility, the skill ingests user-supplied files which could contain malicious metadata. While this represents an attack surface, the risk is mitigated by the use of robust system binaries and safe command construction.
[METADATA_POISONING]: The skill repository includes a .coverage file, which is an SQLite database generated during testing. This file contains absolute file paths from the author's local development environment, which is a minor configuration oversight.

media-processing