The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/mix.sh is vulnerable to command injection through the use of unsanitized input in dynamic Python execution. Specifically, the variables VO_VOLUME and TOTAL are directly interpolated into python3 -c command strings at lines 135 and 147. A malicious user or an automated process providing a crafted value (e.g., 1.0; import os; os.system('ls')) for the --vo-volume or --total-duration flags could execute arbitrary Python and system commands.
[COMMAND_EXECUTION]: The skill executes ffmpeg and ffprobe using several file paths provided as inputs (--video, --vo, --music, --sfx, --output). These paths are not validated, which could lead to unauthorized file access or exploitation of FFmpeg's protocol handling if malicious paths are supplied.

mix-master