The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/score.py invokes ffmpeg to handle audio conversions, encoding, and loudness analysis.
Evidence: The code uses subprocess.run with list-based arguments for calls to ffmpeg in functions such as wav, decode, meter, and finish.
Analysis: This implementation avoids shell invocation, effectively preventing command injection vulnerabilities while performing legitimate media tasks.
[INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied storyboard and timing data to drive the music arrangement process.
Ingestion points: storyboard.json and beatmap.md files are read in scripts/score.py to extract film metadata and event cues.
Boundary markers: The skill relies on structured JSON parsing and strict frame-based validation within the derive function in scripts/score.py.
Capability inventory: The skill generates audio assets by writing WAV files to the local directory and executing ffmpeg via subprocess.
Sanitization: Input data is validated for numeric types (FPS, frame counts) and existence on a fixed beat grid. Strings are used only for predefined categorical lookups, preventing untrusted data from influencing logic or control flow.
[SAFE]: The skill utilizes reputable open-source dependencies and operates on local assets within a dedicated workflow.
Evidence: Usage of numpy, scipy, pedalboard, and librosa for core synthesis and digital signal processing logic.
Analysis: These are standard industry tools for the described tasks. While some version pins in requirements.txt are higher than current releases, the package names themselves are legitimate and used as intended.

motion-score