The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/sound.mjs is vulnerable to shell command injection. It utilizes execFileSync to invoke a shell (sh -c) with a command string constructed via template literals that include unsanitized command-line arguments. Specifically, the --lufs parameter and the output file path are directly interpolated into the command string. If an agent is directed to process a file with a maliciously crafted name or parameter (e.g., containing ; touch /tmp/pwned; #), it will result in arbitrary shell command execution on the host system.
Evidence in scripts/sound.mjs: execFileSync("sh", ["-c", ffmpeg ... -i "${tmp}" -af loudnorm=I=${I}:...]) where tmp is derived from user-provided file paths and I is taken from the --lufs flag.
[INDIRECT_PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection as it exposes powerful system capabilities (shell execution) to inputs that can be influenced by external data.
Ingestion points: The skill ingests untrusted data through command-line arguments (file paths and numeric parameters) and the cues.json file in scripts/sound.mjs.
Boundary markers: The skill lacks boundary markers or sanitization logic to prevent embedded shell metacharacters from escaping the intended command string context.
Capability inventory: The skill utilizes execFileSync, spawn, and fs.writeFileSync to interact with the OS and external binaries like FFmpeg and FFprobe.
Sanitization: No escaping, validation, or filtering is performed on the variables I or tmp before they are interpolated into the shell command executed via sh -c.

claude-animation