The Agent Skills Directory

[COMMAND_EXECUTION]: Multiple scripts, including generate_scene.py, assemble_story.py, editors_quality_room.py, and generate_pipeline_diagram.py, execute external binaries (ffmpeg, ffprobe, gcloud, dot) using subprocess.run(..., shell=True) or subprocess.Popen(...). The commands are constructed using string interpolation of variables such as file_path, project_dir, and image_file without sanitization. An attacker who can influence these paths or filenames could achieve arbitrary command execution.
Evidence in scripts/generate_scene.py: subprocess.run(f"gcloud storage cp {image_file} {gcs_uri}", shell=True)
Evidence in scripts/editors_quality_room.py: subprocess.run(f"ffprobe -v error -show_entries format=duration -of default=noprint_wrappers=1:nokey=1 {file_path}", shell=True)
Evidence in scripts/assemble_story.py: subprocess.run(cmd, shell=True) where cmd is an f-string including video_path and norm_path.
[REMOTE_CODE_EXECUTION]: The identified command injection vulnerabilities provide a direct path for remote code execution on the system hosting the agent skill.
[INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied story scripts, character details, and multimedia prompts which are passed to generative models and MCP tools.
Ingestion points: User-provided Story Bible content (narrative, prompts) defined in SKILL.md and processed by generate_scene.py.
Capability inventory: High-privilege shell execution via subprocess, file system writes, and network operations via gcloud and MCP tool calls.
Boundary markers: Lacks robust delimiters or warnings to ignore embedded instructions in the narration text.
Sanitization: Basic negative filtering is applied to music prompts, but is insufficient to prevent sophisticated prompt injection attacks.

story-generator