The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to read and process an external transcript file (audio.json) in Step 3 of SKILL.md. This creates a surface for indirect prompt injection, where malicious instructions embedded in a transcript could manipulate the agent's output (clips.json).
Ingestion point: audio.json is read by the agent as instructed in SKILL.md.
Boundary markers: The instructions lack delimiters or warnings to ignore instructions inside the transcript.
Capability inventory: The make-clips.py script performs file writes (open(..., 'w')) and executes shell commands (subprocess.run).
Sanitization: Neither the skill instructions nor the Python script perform validation or sanitization on the data extracted by the agent (e.g., the rank or hook fields).
[COMMAND_EXECUTION]: The script make-clips.py uses subprocess.run and subprocess.check_output to execute ffmpeg and ffprobe. While these calls use argument lists to mitigate shell injection, the parameters passed to ffmpeg (such as the rank value used in filenames and filter strings) are derived from the AI-processed transcript. A malicious transcript could lead to path traversal (e.g., using a rank like ../../etc/passwd) or filter injection within the ffmpeg command string.

call-clips