The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill's installation instructions include downloading and installing the hdr10plus_tool from a public GitHub repository (https://github.com/quietvoid/hdr10plus_tool) using cargo install. This is standard behavior for a utility that wraps a specific external binary.
[COMMAND_EXECUTION]: The Python script scripts/hdr10plus.py executes external tools (hdr10plus_tool, x265, ffmpeg, etc.) using subprocess.run(). It correctly uses list-based arguments and shlex.quote() for logging, which prevents shell command injection vulnerabilities.
[COMMAND_EXECUTION]: The x265-encode subcommand allows for an --extra parameter that accepts user-supplied strings which are split using shlex.split() before being appended to the execution command. This allows passing additional flags to the x265 binary safely without enabling shell execution.
[PROMPT_INJECTION]: The skill processes external video files and JSON metadata provided by the user, creating a surface for indirect prompt injection.
Ingestion points: Path arguments for input video files and JSON configuration files provided via the CLI to scripts/hdr10plus.py.
Boundary markers: None present; the script passes the input directly to the target binaries.
Capability inventory: The skill can execute multiple external binaries with user-influenced arguments and write resulting files to the filesystem.
Sanitization: The script uses Path objects to handle file paths and shlex.split() to sanitize additional encoder flags, mitigating basic injection risks.

hdr-hdr10plus-tool