The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses a Python script (scripts/gpac.py) to wrap the MP4Box and gpac command-line utilities. Commands are executed via subprocess.run() using a list-based argument structure without a shell, which prevents command injection vulnerabilities. The script also safely manages temporary files using tempfile.mkstemp and performs standard file operations like moving and copying to manage tool outputs.
[PROMPT_INJECTION]: The SKILL.md file interpolates the $ARGUMENTS variable into the agent's movie context. While this lacks explicit boundary markers (such as XML tags or unique delimiters) to separate user-supplied data from instructions, this is a standard design pattern for technical tools and is considered a low-risk vulnerability surface. The skill does not contain any instructions that attempt to bypass safety filters or override agent behavior.

media-gpac