The Agent Skills Directory

[COMMAND_EXECUTION]: The skill makes extensive use of the subprocess module to orchestrate media processing workflows. Specifically, it calls system utilities like ffmpeg, ffprobe, magick (ImageMagick), Xvfb, and xdotool. These calls use list-based arguments to safely handle variables and avoid shell injection vulnerabilities. Example files include tools/agent_browser_recorder.py, tools/demo_video_composer.py, and tools/video_captioner.py.
[EXTERNAL_DOWNLOADS]: The skill interacts with multiple external AI services and cloud providers to generate and retrieve media assets. It communicates via HTTPS with OpenAI, HeyGen, ElevenLabs, Groq, Fal.ai, and Replicate APIs. Additionally, it contains logic for uploading and downloading content from AWS S3 buckets. These operations are performed using official client libraries or standard HTTP request methods and are directed at well-known, trusted service domains.
[PROMPT_INJECTION]: The skill contains a vulnerability surface for indirect prompt injection as it ingests and processes untrusted data from the web. Using Playwright, it navigates to user-specified URLs to record browser sessions or capture screenshots. While the skill primarily processes this data as visual media, the underlying agent may be exposed to instructions embedded in page content during the research or intake phases. This is a common risk for tools that process external web content and is mitigated by the skill's specific editorial guardrails and taste rules described in SKILL.md and REFERENCE.md.

super-video-maker