The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes several standard shell utilities to perform its primary function of file deduplication.
Evidence includes the use of find, sha256sum, mv, and rm for identifying and managing duplicate files.
The logic includes safety measures such as quoting variables ("$f", "$SRC") to prevent shell injection from file paths containing special characters.
[EXTERNAL_DOWNLOADS]: The skill mentions the use of the Pillow (PIL) library for image processing in perceptual mode.
The instruction suggests installing the package via uv pip install Pillow if it is missing from the environment.
Pillow is a well-known and trusted Python library for image manipulation.
[PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface as it processes untrusted data (file names) from the file system.
Ingestion points: File names are retrieved via the find command and stored in the FILES array in SKILL.md.
Boundary markers: None explicitly present for file names, but they are treated as data rather than instructions.
Capability inventory: The skill has capabilities to move (mv) and delete (rm) files, and execute python scripts (python3).
Sanitization: The skill mitigates risks by using proper shell quoting and list-based arguments in Python subprocess calls, preventing the execution of commands embedded in file names.
[SAFE]: The dynamic execution of the Python script /tmp/dhash_clip.py is categorized as safe as it is generated from a static template within the skill to provide necessary functionality (perceptual hashing) and does not fetch or execute arbitrary remote code.

dedupe-clips