The Agent Skills Directory

[COMMAND_EXECUTION]: The skill's Python-based metadata parser uses the eval() function to process the r_frame_rate field returned by ffprobe. Because this data originates from the metadata of the video file being processed, a maliciously crafted video file could contain executable code in that field, leading to arbitrary code execution when the /extract-video info command is used.
[COMMAND_EXECUTION]: The execution script interpolates user-provided variables like $VIDEO_PATH directly into shell commands. While the script uses double quotes to mitigate simple argument splitting, it relies on the safety of the input and the underlying shell environment to prevent more complex command injection attacks.

extract-video