The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The script scripts/matte.py utilizes PyTorch's torch.hub.load function with trust_repo=True to retrieve and execute code from the PeterL1n/RobustVideoMatting GitHub repository. This mechanism allows arbitrary remote code execution from a source that is not explicitly categorized as trusted.\n- [EXTERNAL_DOWNLOADS]: During the first run of the matting process, the skill downloads model weights and supporting scripts from an external GitHub repository to the local environment.\n- [INDIRECT_PROMPT_INJECTION]: The skill possesses a vulnerability surface for indirect prompt injection during data processing.\n
Ingestion points: Untrusted data is processed from the WORDS global variable (imported from words.js) and item lists provided by the user within video.js.\n
Boundary markers: The skill lacks explicit boundary markers or instructions to disregard potential commands nested within the processed data strings.\n
Capability inventory: The skill handles local file system operations (creating directories and saving images) in scripts/matte.py and dynamic HTML generation in the JavaScript template.\n
Sanitization: Basic HTML character escaping is implemented via an internal esc function, which mitigates simple cross-site scripting but not logical prompt injection.

tier-list