The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/whip.py executes system commands via subprocess.call() and subprocess.run().
Evidence:
The script executes ffmpeg -version and ffmpeg -muxers to verify environment compatibility.
The publish and publish-screen subcommands build and execute ffmpeg command lines using subprocess.call().
[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by ingesting external data (WHIP endpoints and tokens) that influence the execution of the FFmpeg command.
Ingestion points: The --endpoint and --token arguments in scripts/whip.py accept user-controlled strings.
Boundary markers: No explicit delimiters or warnings are used to sanitize or isolate these inputs within the generated command line.
Capability inventory: The skill can execute shell commands (ffmpeg) and access network resources (the WHIP endpoint).
Sanitization: The script passes arguments to subprocess.call() as a list, which provides native protection against standard shell injection, though it remains a surface for argument injection if endpoints are malformed.

ffmpeg-whip