The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/review_render.py uses subprocess.run to execute ffmpeg, curl, and whisper. These calls use argument lists rather than shell strings, which effectively prevents command injection. The operations are limited to extracting audio, checking volume, and calling transcription services.\n- [DATA_EXFILTRATION]: The skill transmits extracted audio data to external transcription APIs. Specifically, it contacts a GooseWorks proxy and OpenAI's Whisper API. To authenticate, it reads credentials from ~/.gooseworks/credentials.json and the OPENAI_API_KEY environment variable. This data flow is consistent with the skill's stated purpose of audio transcription and uses well-known or vendor-owned endpoints.\n- [INDIRECT_PROMPT_INJECTION]: The skill transcribes audio from external video files, creating a potential surface for indirect prompt injection.\n
Ingestion points: Audio data is ingested from the video file path provided to the --video argument in scripts/review_render.py.\n
Boundary markers: There are no boundary markers or delimiters used within the audio processing or the resulting text transcription.\n
Capability inventory: The skill has capabilities to read files, execute subprocesses, and perform network requests via curl.\n
Sanitization: The transcribed text is compared to a reference script using difflib.SequenceMatcher to generate a similarity ratio and word-diff. The risk is assessed as low because the skill functions as a deterministic gate rather than an autonomous actor.

review-ugc-render