The Agent Skills Directory

[COMMAND_EXECUTION]: Multiple Python scripts in the scripts/ directory use subprocess.run or subprocess.Popen with shell=True to execute system utilities such as ffmpeg, ffprobe, gcloud, and dot.
In editors_quality_room.py, the functions get_duration, get_audio_params, and get_video_params interpolate the file_path variable directly into command strings without any quoting or escaping (e.g., cmd = f"ffprobe ... {file_path}"). This allows for potential command injection if a filename contains shell metacharacters.
In generate_scene.py, the script executes gcloud storage cp {image_file} {gcs_uri} and multiple ffmpeg commands where variables representing file paths and complex filter strings are interpolated into shell strings without sufficient sanitization.
In assemble_story.py, while some variables are enclosed in double quotes, the overall pattern of using shell=True with dynamically generated paths and glob results remains a security concern.
[INDIRECT_PROMPT_INJECTION]: The skill presents a surface for indirect prompt injection as it ingests and processes untrusted user-provided content which is then passed as arguments to generative media tools.
Ingestion points: User-provided narrator text and prompts for image, video, and music generation are collected and passed as command-line arguments to generate_scene.py.
Boundary markers: The skill does not implement boundary markers or instructions to the model to ignore embedded commands within the story content.
Capability inventory: The skill possesses broad system capabilities, including file system access, network operations through the gcloud CLI, and the execution of complex shell commands via subprocess.
Sanitization: There is no evidence of input validation or sanitization of the user-provided text before it is interpolated into tool calls or executed within shell environments.

story-generator