The Agent Skills Directory

[COMMAND_EXECUTION]: Multiple Python scripts including scripts/assemble_story.py, scripts/editors_quality_room.py, scripts/generate_pipeline_diagram.py, and scripts/generate_scene.py use subprocess.run() or subprocess.Popen() with shell=True. Commands are constructed by interpolating variables such as file paths and directory names that are derived from tool outputs or user-provided arguments.
Evidence: In scripts/generate_scene.py, the ffmpeg mixing command is built using variables extracted from external tool outputs via regular expressions. If these outputs are manipulated via prompt injection, it could lead to arbitrary shell command execution.
[DATA_EXFILTRATION]: The skill performs network operations to transfer data to external infrastructure.
Evidence: scripts/generate_scene.py uses gcloud storage cp to upload generated images to a hardcoded Google Cloud Storage bucket (gs://genai-blackbelt-fishfooding-assets). While this appears consistent with the vendor author (GoogleCloudPlatform), it represents a network exfiltration path for locally generated or retrieved assets.
[PROMPT_INJECTION]: The skill exhibits a surface for indirect prompt injection (Category 8) as it processes untrusted user input that influences sensitive operations.
Ingestion points: User-provided narration text, image prompts, and story titles are ingested via CLI arguments in scripts/generate_scene.py and scripts/generate_report.py.
Boundary markers: No explicit delimiters or boundary markers are used when passing these strings to generative models or shell commands to differentiate instructions from data.
Capability inventory: The skill has significant capabilities, including file system access, shell command execution (ffmpeg, gcloud, zip), and interaction with external AI services via MCP tools.
Sanitization: There is no evidence of shell metacharacter escaping or HTML sanitization for user-provided strings before they are used in command lines or interpolated into the HTML report template.

story-generator