The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The script scripts/video_editor.py uses the eval() function to parse frame rate data (r_frame_rate) obtained from ffprobe. Since ffprobe parses metadata from untrusted video files provided to the agent, this creates a direct vector for arbitrary code execution if a maliciously crafted file can influence the output string.
[COMMAND_EXECUTION]: All primary scripts (audio_mixer.py, batch_processor.py, motion_graphics.py, quality_assessment.py, thumbnail_generator.py, timelapse_creator.py, and video_editor.py) rely on subprocess.run() to execute shell commands (ffmpeg and ffprobe). While the tools generally use list-based arguments to mitigate shell injection, the broad access to system commands and complex filter strings interpolated from user-supplied parameters represents a significant capability surface that can be abused.
[PROMPT_INJECTION]: The skill processes untrusted metadata from external video files using ffprobe. This creates an indirect prompt injection surface where malicious content embedded in video metadata (e.g., title, comment, or other tags) could influence the agent's behavior when it interprets the results of analysis or automated editing operations.

video-processing-editing