The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes external command-line utilities whisper and ffmpeg to perform audio transcription and re-encoding.
The execution in align.py uses subprocess.run with arguments passed as a list, which prevents shell injection by avoiding shell interpolation.
The skill checks for the existence of required binaries using shutil.which before execution.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user data, including audio files and script JSON, which represents a potential attack surface for indirect prompt injection.
Ingestion points: User-provided audio is transcribed via Whisper in _run_whisper, and script.json is parsed in _run (align.py).
Capability inventory: The skill has the ability to write files to the local file system and execute specific media processing commands, but it does not have network access.
Sanitization: The skill does not sanitize transcribed text or script content, instead instructing the user to "spot-check timing.json" for errors.
This surface is considered a low-risk inherent property of transcription and alignment tools.

align-narration