The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes shell heredocs to dynamically generate and execute Python scripts. It directly interpolates shell variables ($SRC and $GOAL) into these scripts without sanitization or escaping. This allows an attacker or a malicious prompt to inject arbitrary Python code by including quotes or command sequences in the goal/prompt string.
[EXTERNAL_DOWNLOADS]: The skill documentation and logic rely on the installation of software from external, third-party GitHub repositories (browser-use/video-use and HKUDS/VideoAgent) that are not recognized as trusted sources. These repositories are outside the control of the platform and could host malicious code.
[PROMPT_INJECTION]: The skill has a surface for indirect prompt injection. It ingests and processes untrusted data from video files and user-defined goals using LLM-based backends. There are no boundary markers or sanitization processes to prevent malicious instructions embedded within the video content (audio or visual) from influencing the agent's behavior. Given the skill's capabilities to execute shell commands and modify the file system (via ffmpeg, jq, and Python), such an injection could lead to unauthorized file operations or system manipulation. Evidence found in SKILL.md for ingestion points includes video file paths and the user goal prompt. Capability inventory includes file system access, network operations, and command execution. No sanitization or robust boundary markers are present.

agentic-edit