The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill utilizes npm exec to download and run the @volcengine/kickart-open-mcp package directly from the NPM registry. This package is an official resource provided by the vendor (ByteDance/Volcengine) for interfacing with their KickArt platform.
[COMMAND_EXECUTION]: The skill interacts with the KickArt platform by executing shell commands via the kickart-open-cli. It mitigates command injection risks by instructing the agent to pass all user-provided data, such as file paths and URLs, as independent shell parameters rather than concatenated strings.
[INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied data (video URLs, product info, prompts), representing a vulnerability surface. However, this is mitigated by the following mandatory evidence chain: 1) Ingestion points: references/视频参考指南.md and references/爆款裂变指南.md where user data is collected; 2) Boundary markers: Mandatory '成片信息' display and '二次确认' consent flow before any processing; 3) Capability inventory: CLI-based task submission and material upload restricted to the vendor's platform; 4) Sanitization: Strict file validation (extension, size, resolution) and shell argument isolation.
[CREDENTIALS_UNSAFE]: The skill handles platform authentication via OAuth. It includes explicit instructions to ensure access tokens are not logged or displayed, ensuring sensitive credentials remain protected during the session and are only passed to the official vendor tool.

byted-kickart-viral-replicator