The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill accepts untrusted data through CLI arguments (--theme, --character) and JSON script files which are then used to construct prompts for the video generation model.
Ingestion points: The theme and character_desc parameters in scripts/manga_drama.py and the prompt field within the script JSON files.
Boundary markers: None. The skill directly interpolates user input into prompt templates using f-strings and the .format() method without delimiters.
Capability inventory: The skill can write files to the local system, make outbound network requests via urllib, and execute the curl binary via subprocess.run.
Sanitization: No sanitization or input validation is performed on the user-supplied strings before they are sent to the AI model.
[COMMAND_EXECUTION]: The skill relies on the system's curl binary to download generated videos.
Evidence: In scripts/seedance_video.py, subprocess.run is called with a list of arguments including curl to fetch video content from remote URLs.
[EXTERNAL_DOWNLOADS]: The skill interacts with external infrastructure to perform its primary function.
Evidence: It communicates with the Volcengine Ark API at ark.cn-beijing.volces.com to trigger video generation tasks and downloads the resulting media files. Volcengine is a well-known service.
[SAFE]: The skill explicitly disables SSL verification for its network requests.
Evidence: scripts/seedance_video.py contains code setting ssl_context.check_hostname = False and ssl_context.verify_mode = ssl.CERT_NONE. While this is a violation of security best practices that increases susceptibility to man-in-the-middle attacks, it is not an inherently malicious behavior in this context.

manga-drama