The Agent Skills Directory

[DYNAMIC_EXECUTION]: The script scripts/sync.py performs dynamic code loading by manually inserting a directory into the Python system path (sys.path) and importing the whisper module. The path is computed at runtime based on the user's home directory (~/.claude/plugins/cache/claude-video/watch/0.1.2/scripts), which creates a dependency on external file system state and executes code from outside the skill's own directory.
[COMMAND_EXECUTION]: The script scripts/sync.py uses subprocess.run to invoke the ffmpeg binary for extracting audio from video files, burning subtitles into the output video, and generating waveform previews. While these calls use argument lists rather than shell strings, they grant the skill control over system binaries for file processing.
[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it processes untrusted lyric data and word timestamps provided via command-line arguments. This data is interpolated into SubStation Alpha (ASS) subtitle files which are subsequently processed by ffmpeg filters.
Ingestion points: The --lyrics and --timestamps arguments in scripts/sync.py accept external text and JSON files.
Boundary markers: The skill does not use explicit boundary markers or instructions to the agent to ignore embedded instructions within the ingested lyric content.
Capability inventory: The skill has the capability to write to the file system and execute ffmpeg commands via subprocess.
Sanitization: The render_ass function replaces curly braces ({ and }) with parentheses to mitigate SubStation Alpha tag injection. Additionally, the parse_lyrics function strips markdown backticks and specific hidden Unicode characters (Zero-Width Space and Byte Order Mark) from the input text to prevent rendering issues.

sync-captions-to-music