The Agent Skills Directory

[DYNAMIC_EXECUTION]: The script scripts/main.py uses the eval() function to calculate the frame rate from metadata provided by ffprobe (line 316: eval(stream.get('r_frame_rate', '0/1'))). Because this data originates from external video files, a maliciously crafted file with a specially formatted frame rate string could trigger arbitrary code execution within the Python environment.
[COMMAND_EXECUTION]: The skill makes extensive use of subprocess.run() to execute ffmpeg and ffprobe binaries. While the script generally uses the list-based argument format to mitigate simple command injection, the broad execution of external tools on user-provided files presents an inherent attack surface.
[PERSISTENCE]: The concat command in scripts/main.py writes to a hardcoded temporary file path /tmp/concat_list.txt. While not a direct persistence mechanism, the use of a predictable global temporary path can be susceptible to symlink attacks or race conditions in shared environments.

video-processing