The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The scripts/setup-ltx-wsl2.sh script downloads the uv installer from astral.sh, which is a well-known service for Python development tools. The installation process uses a shell pipe for immediate execution.
[REMOTE_CODE_EXECUTION]: Automated setup scripts (scripts/setup-ltx.sh and scripts/setup-ltx-wsl2.sh) perform remote code operations including cloning the LTX-2 source code from GitHub and downloading large model weights from Hugging Face's official repositories.
[COMMAND_EXECUTION]: The scripts/ltx-server.py file uses asyncio.create_subprocess_exec to run the video generation pipeline. This command is constructed using various parameters provided by the user via the API, such as the text prompt and configuration file paths. The use of an unvalidated configuration path presents a path traversal vulnerability where a malicious user could potentially reference arbitrary files on the host system.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it processes untrusted text descriptions and image data from the user and passes them to the underlying diffusion model.
Ingestion points: The prompt and conditioning_image fields in the GenerateRequest model in scripts/ltx-server.py.
Boundary markers: None identified; input is passed as command-line arguments to the inference process.
Capability inventory: Subprocess execution for running the video generation pipeline and system-level GPU queries (nvidia-smi) in scripts/ltx-server.py.
Sanitization: Resolution-based validation is performed, but no sanitization of the text prompt or validation of the configuration file path is implemented.

ltx-video