The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses the Bash tool to execute CLI commands for video analysis when the MCP server is not available.
[EXTERNAL_DOWNLOADS]: Uses the npx command to fetch the mcp-video-analyzer package from the npm registry at runtime.
[REMOTE_CODE_EXECUTION]: Executes remote code via npx -y mcp-video-analyzer@latest. While this package is associated with the skill author, fetching the latest version at runtime means the executed code is not pinned to a specific, verified version.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external video sources which could contain malicious instructions.
Ingestion points: Transcripts, OCR results (on-screen text), and video metadata are extracted from external URLs (YouTube, TikTok, Loom, etc.) and passed into the agent's context.
Boundary markers: The instructions do not define clear delimiters or include warnings for the agent to ignore instructions embedded within the video content.
Capability inventory: The skill has access to powerful tools including Bash (shell access) and Read (file system access), which could be targets for an injection attack.
Sanitization: There is no evidence of sanitization or filtering applied to the extracted video data before it is presented to the agent for analysis.

video