The Agent Skills Directory

[COMMAND_EXECUTION]: The skill scripts (gen.mjs, video.mjs, and providers.mjs) utilize the child_process.spawn method to execute local commands for video synthesis and AI model interaction.
Evidence: scripts/video.mjs spawns ffmpeg for video stitching and gen.mjs for individual frame/clip generation. scripts/lib/providers.mjs spawns the dlazy CLI binary to interact with the vendor's API.
Security Note: The implementation uses argument arrays with spawn rather than exec with shell interpolation, which is the recommended practice for preventing command injection vulnerabilities.
[INDIRECT_PROMPT_INJECTION]: The skill acts as a bridge between user-supplied prompts/images and remote AI models, creating a surface for indirect injection.
Ingestion points: User-provided prompts and image paths are ingested via command-line arguments in scripts/gen.mjs and scripts/video.mjs.
Capability inventory: The skill can write generated video/image files to the local file system (persist function in gen.mjs) and perform network requests to AI backends.
Sanitization: The scripts treat prompt inputs as data strings for API payloads or CLI arguments. While no complex sanitization is present, the use of spawn limits the risk of the prompt influencing the local execution environment.
[EXTERNAL_DOWNLOADS]: The skill documentation and scripts reference external tools and repositories for extended functionality.
Evidence: references/provider-cli.md refers to the @dlazy/cli NPM package, and scripts/brand.mjs references the dlazy-ai/ecommerce-skills repository on GitHub.
Note: These resources are owned by the skill author or hosted on well-known, trusted platforms (NPM, GitHub).

main-image-video