The Agent Skills Directory

[DYNAMIC_EXECUTION]: The script scripts/deapi.py uses importlib.import_module to load command modules from the deapi_lib.commands package. This allows the skill to load local logic dynamically based on user commands.
[COMMAND_EXECUTION]: The skill executes the ffprobe utility via subprocess.run in scripts/deapi_lib/core.py. This is used to probe media files for duration and metadata. Arguments are passed as a list to avoid shell interpolation.
[DATA_EXFILTRATION]: The skill transmits user-selected files to the vendor's API at api.deapi.ai. It includes a safety mechanism in scripts/deapi_lib/core.py (_sensitive_path) that blocks access to sensitive local directories and files (e.g., .ssh, .env, .aws) to prevent accidental credential exfiltration. The validate_base_url function also ensures the API key is only sent to *.deapi.ai domains.
[INDIRECT_PROMPT_INJECTION]: The skill has a vulnerability surface for indirect injection as it processes external content from audio transcripts, OCR, and video descriptions.
Ingestion points: transcribe in scripts/deapi_lib/commands/audio.py, ocr in scripts/deapi_lib/commands/image.py, and describe in scripts/deapi_lib/commands/video.py.
Boundary markers: SKILL.md contains explicit instructions to the agent to treat results as data and ignore any embedded commands.
Capability inventory: The skill can write files, perform network uploads, and execute subprocesses (ffprobe) as defined in scripts/deapi_lib/core.py.
Sanitization: No explicit text sanitization or escaping is performed on the extracted content before it is returned to the agent.

deapi