The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes user-defined files, specifically demo-config.ts and VOICEOVER-SCRIPT.md, to generate video content. The text from these files is interpolated into shell commands (e.g., arguments for qwen3_tts.py) without explicit sanitization or boundary markers, creating a surface for indirect instructions to influence agent behavior.
Ingestion points: projects/PROJECT_NAME/src/config/demo-config.ts and projects/PROJECT_NAME/VOICEOVER-SCRIPT.md within the skill workspace.
Boundary markers: None identified in the instructional flow.
Capability inventory: The skill utilizes python3 for script execution, npm for dependency management, and the modal CLI for cloud deployments and remote compute.
Sanitization: There is no mention of escaping or validating user-provided text before it is passed to command-line tools.
[COMMAND_EXECUTION]: The toolkit relies on a high volume of shell commands for its core functionality, including environment setup (pip3 install), project initialization (npm install), and asset generation. While these are necessary for a video toolkit, they represent a significant execution surface over user-controlled data.
[EXTERNAL_DOWNLOADS]: The skill interacts with well-known cloud services and repositories, including Modal, Cloudflare R2, and HuggingFace, for model hosting and data storage. It also downloads software dependencies from official registries like NPM and PyPI using standard package managers.

video-toolkit