The Agent Skills Directory

[PROMPT_INJECTION]: The skill processes untrusted external data such as transcripts, captions, podcasts, webinars, and third-party sources during the clipping plan phase. This represents a vulnerability to indirect prompt injection where instructions hidden in the data could influence agent behavior.
Ingestion points: SKILL.md Phase 3 (transcripts, third-party sources) and Phase 0 (general project files, landing pages).
Boundary markers: Absent. The skill does not instruct the agent to ignore or delimit instructions found within these sources.
Capability inventory: The skill performs file reads across the project, writes to the workspace, and potentially executes commands from a scripts directory.
Sanitization: Absent. No escaping or filtering is applied to the ingested content before it is used for script generation.
[DATA_EXFILTRATION]: Phase 0 instructs the agent to "Search for email/ad/analytics config" and read "any project files" to discover product context. While intended for discovery, this broad search pattern may inadvertently read sensitive configuration files, API keys, or environment variables that are not strictly necessary for generating video scripts.
[COMMAND_EXECUTION]: The skill references the execution of commands located in a scripts/ directory. While it includes a safety note to skip unavailable commands and avoid hallucinating output, the resolution of these paths involves dynamic ancestor lookups and includes directories like ~/.claude/kai. This reliance on external scripts adds a layer of complexity to the execution environment.

kai-video