The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill automatically installs Python packages (fal-client, jinja2) and Node.js dependencies (npm install within the remotion/ directory) during execution if they are not already present.
[COMMAND_EXECUTION]: The skill executes multiple shell commands using the subprocess module to invoke ffmpeg, ffprobe, npm, and npx remotion for tasks such as audio extraction, video probing, and caption rendering.
[DATA_EXFILTRATION]: Audio extracted from the user's video is uploaded to fal.ai via the fal-client library to obtain word-level timestamps. While necessary for the skill's primary function, this involves sending potentially sensitive audio content to an external third-party AI provider.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection through malicious transcription data processed during rendering.
Ingestion points: Transcription text received from the fal.ai API response in scripts/transcribe.py and user-provided corrections in scripts/caption.py.
Boundary markers: No explicit delimiters or warnings are used to prevent the agent or rendering engine from interpreting instructions within the transcript.
Capability inventory: The skill uses ffmpeg (scripts/burn.py) and npx remotion (scripts/remotion_render.py) to process subtitle data, which can include override tags.
Sanitization: The skill lacks sanitization when interpolating transcript text into Jinja2 templates (scripts/ass_render.py) and React components (remotion/src/CaptionedVideo.tsx).

burn-in-captions