The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses the subprocess module across multiple Python scripts to interface with media processing utilities like ffmpeg, ffprobe, yt-dlp, and ImageMagick. These calls are constructed as argument lists rather than raw shell strings, which effectively prevents typical command injection vulnerabilities. These tools are used solely for their intended media processing functions.
[EXTERNAL_DOWNLOADS]: The skill facilitates the download of a Whisper AI model from a HuggingFace repository (huggingface.co) to support its speech-to-text functionality. It also utilizes yt-dlp to fetch metadata and captions from YouTube. HuggingFace is a trusted organization, and YouTube is a well-known service; these operations are standard for the skill's transcription and alignment features.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external sources, including YouTube captions (via yt-dlp) and user-provided transcript segments. The skill possesses extensive capabilities to execute subprocess calls (ffmpeg, ffprobe, magick, yt-dlp) across various modules (e.g., build-captions.py, build-overlays.py). However, the data is processed through specialized scripts that implement sanitization logic, such as escape_drawtext for FFmpeg filter safety and automated text cleaning in the caption builder, which significantly reduces the surface for adversarial data to influence the agent's behavior. (Severity: LOW).
[SAFE]: The skill follows secure credential management practices by instructing the agent in HOUSEKEEPING.md to utilize environment variables or .env files for API keys and prohibiting their inclusion in logs, shell commands, or generated output files, aligning with standard security best practices for agentic workflows.

fountain-clip-producer