The Agent Skills Directory

[COMMAND_EXECUTION]: The shell scripts scripts/audio_subtitle_gen.sh and scripts/ffmpeg_assembly.sh utilize unquoted shell variable assignments (e.g., text=$1, input_video=$1). This practice can lead to command injection or unexpected execution behavior if user-supplied text or filenames contain spaces, backticks, or other shell-special characters.
[EXTERNAL_DOWNLOADS]: The workflow in SKILL.md (Step 6) explicitly instructs the agent to use curl or wget to download background music (BGM) from external public libraries. These external sources are not predefined or restricted, allowing the agent to fetch content from potentially untrusted third-party domains.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection (Category 8). It ingests untrusted data from user-supplied text and external URLs, which are then interpolated into AI video generation prompts and TTS scripts without sanitization or boundary markers.
Ingestion points: User-provided copy/text in SKILL.md and URLs processed by scripts/record_scroll.py.
Boundary markers: Absent. The skill relies on a manual user confirmation step in SKILL.md, which an agent might bypass if instructed by injected text.
Capability inventory: Subprocess execution of ffmpeg, bash, python, and playwright; network operations via curl, wget, and browser automation.
Sanitization: No escaping, filtering, or validation is performed on the input text before passing it to shell scripts or tool APIs.
[DATA_EXFILTRATION]: The inclusion of scripts/record_scroll.py which uses playwright to visit arbitrary user-provided URLs creates a risk of Server-Side Request Forgery (SSRF). This could allow the agent to access internal network services, cloud metadata endpoints, or local files if the environment is not sufficiently isolated.

Video Producer