The Agent Skills Directory

[COMMAND_EXECUTION]: The skill invokes ffmpeg, ffprobe, and a headless browser via execFileSync. This method is resistant to shell injection as arguments are passed as an array. Command construction for FFmpeg's sendcmd feature is strictly limited to sanitized numerical coordinates and indices.
[INDIRECT_PROMPT_INJECTION]: The skill processes shots.json which may contain untrusted text. Ingestion points: shots.json metadata (in scripts/video-sync.mjs). Boundary markers: Absent (uses structured data instead of prompts). Capability inventory: execFileSync (executes ffmpeg/chrome), writeFileSync (writes temporary command files and HTML). Sanitization: r2() for numbers, esc() for strings, and JSON-safe injection in panelHtml. It mitigates injection risks by rounding all numeric inputs and HTML-escaping all string inputs before they are processed by the headless browser or FFmpeg. The data flow does not reach an LLM prompt, further isolating the execution environment.
[EXTERNAL_DOWNLOADS]: The skill operates entirely offline with zero NPM dependencies. It relies solely on the Node.js standard library and pre-installed system binaries, preventing supply chain attacks or unauthorized network activity.
[OBFUSCATION]: The source code is clear and includes a self-test suite (scripts/selftest.mjs). No hidden payloads, encoded strings, or suspicious logic patterns were identified.

video-sync