The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/compare.py uses subprocess.run to call external binaries ffmpeg and ffprobe. These calls are implemented using lists for command arguments rather than shell strings, which effectively prevents shell injection via malicious filenames.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external video files provided via the --reference and --target arguments. This creates a surface for indirect prompt injection where adversarial visual content (e.g., text embedded in frames) could attempt to override the LLM's qualitative review instructions.
Ingestion points: scripts/compare.py reads and processes video files provided via CLI arguments.
Boundary markers: The SKILL.md provides a structured rubric for Step 4, which acts as a logical constraint, but there are no technical delimiters used when the LLM 'reads' the extracted image frames.
Capability inventory: The skill can execute local shell commands (ffmpeg, ffprobe) and has filesystem write access to create the comparison grid and modify storyboard.html.
Sanitization: There is no sanitization or filtering of the visual content within the extracted frames or the metadata returned by ffprobe.

compare-with-reference-video