The Agent Skills Directory

[DATA_EXFILTRATION]: The serve_review_page.py script starts a local HTTP server that includes a /local-media/ route. This route accepts absolute file paths from the URL (e.g., /local-media/C:/Users/...) and serves the file content. Combined with the Access-Control-Allow-Origin: * header, this creates a significant data exposure risk where a malicious website visited by the user could potentially read arbitrary files from the user's local filesystem while the server is running.
[REMOTE_CODE_EXECUTION]: The scripts/local_asr.py script uses torch.hub.load to download and execute code from the snakers4/silero-vad repository at runtime. While this is a common practice for loading ML models, it introduces a dependency on external code that is not verified during installation.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted media content and ASR transcripts that are later used by the Agent for semantic correction and editing decisions.
Ingestion points: pipeline_url_to_asr.py (audio/URL), scripts/merge_asr_words.py (ASR JSON).
Boundary markers: Absent. The skill does not use delimiters or instructions to ignore embedded commands in the transcripts.
Capability inventory: subprocess.run (ffmpeg), requests.post (Bytedance APIs), and local file write operations.
Sanitization: Absent. External content is interpolated directly into prompts.
[COMMAND_EXECUTION]: Multiple scripts (ffmpeg_utils.py, local_asr.py, export_server.py) use the subprocess module to execute shell commands like ffmpeg and other Python scripts. While intended for media processing, these calls use variables derived from file paths and task names, which could be exploited if not properly sanitized.

byted-mediakit-voiceover-editing