The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts compress.py, hw_detect.py, and trim_silences.py utilize the subprocess module to execute system commands including ffmpeg, ffprobe, and sysctl. These operations are performed using argument lists rather than shell strings, which follows security best practices to prevent command injection.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted input in the form of video file paths and names provided by the user. These values are interpolated into progress messages and final reports. Although the risk is low, there is a theoretical surface where a maliciously crafted filename could attempt to influence the agent's output during the reporting phase. 1. Ingestion points: User-provided file and directory paths passed via the -i / --input argument in SKILL.md to compress.py and trim_silences.py. 2. Boundary markers: Not present. The skill directly prints filenames into the terminal output and reports. 3. Capability inventory: Executes shell commands via subprocess for video processing and hardware detection; writes video files to the filesystem and log files to the /tmp directory. 4. Sanitization: The skill relies on standard Python Path objects and list-based subprocess calls, but does not specifically sanitize filename strings for potential prompt injection content.
[SAFE]: The skill operates locally on media files provided by the user. No evidence of data exfiltration, hardcoded credentials, or unauthorized network activity was detected. References to installing ffmpeg target a well-known service and are documented neutrally.

video-compressor