The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses the ffmpeg utility to extract thumbnails from video files. This involves executing shell commands where parameters, such as the input filename, are derived from external data. This creates a risk of command injection if the agent does not properly sanitize filenames before passing them to the shell.
[DATA_EXFILTRATION]: The skill is designed to transfer local project files, including videos and scripts, to Google Drive. While this is the intended functionality, the skill includes explicit instructions for setting file permissions to 'anyone' (public link). This capability could be abused to expose sensitive user data to the public internet if the agent is manipulated into changing permissions on the wrong files.
[PROMPT_INJECTION]: The skill presents an indirect prompt injection surface because it reads and processes external project files and metadata.
Ingestion points: The agent reads file metadata (filenames, duration, resolution) and content from 'script.txt' and 'metadata.txt' (SKILL.md).
Boundary markers: No delimiters or warnings are used to instruct the agent to ignore instructions embedded within the processed data.
Capability inventory: The skill can execute shell commands (ffmpeg), read local files, and perform network uploads/permission changes via the Google Drive MCP.
Sanitization: There is no defined process for escaping or validating filenames or metadata content before they are used in operations.

upload-to-drive