The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/kb-write.sh is vulnerable to shell and Python code injection. It uses shell variable interpolation (e.g., "$TITLE", "$TAGS", "$HYPOTHESIS") inside a Python heredoc block (`python3
<<PYEOF ... PYEOF`). Since these variables are derived from untrusted video metadata processed by the agent, a maliciously crafted video title could escape the string context and execute arbitrary Python code during the knowledge base writing process.
[DATA_EXFILTRATION]: Multiple analysis entries in the knowledge-base/entries/ directory (e.g., 2026-03-26_bestia-oscar.md, 2026-03-26_burrow-oscar.md) contain hardcoded absolute file paths referencing the author's local environment (e.g., C:\Users\vip\Downloads\...). This results in the exposure of the author's local directory structure and usernames.
[PROMPT_INJECTION]: The skill is susceptible to Indirect Prompt Injection. It is designed to ingest and analyze untrusted external data (video files and transcriptions). Malicious instructions embedded in a video's metadata or generated transcription could influence the agent's subsequent actions or the content it writes to the knowledge base.
Ingestion points: scripts/extract.sh processes external video files and generates transcriptions via whisper.
Boundary markers: None identified in the prompt templates or scripts to isolate content from instructions.
Capability inventory: The skill can execute shell scripts, run ffmpeg/ffprobe, use python3, and write files to the local file system.
Sanitization: There is no evidence of sanitization or escaping for the extracted metadata before it is passed to the shell scripts or interpolated into templates.

video-content-analyst