The Agent Skills Directory

[COMMAND_EXECUTION]: The script render.py executes ffmpeg and ffprobe using the subprocess module and a helper library. These commands are constructed using argument lists rather than shell strings, which is a secure practice that prevents shell injection vulnerabilities.
[DATA_EXPOSURE_EXFILTRATION]: The skill operates entirely on local files provided by the user (timing, assets, and media clips). No network operations or attempts to access sensitive system directories (like .ssh or .aws) were detected.
[INDIRECT_PROMPT_INJECTION]: The skill processes data from local JSON files (timing.json, assets_index.json). While these are external inputs, they are used strictly for algorithmic shot selection and technical video rendering parameters. The skill does not interpolate untrusted text into instructions that could manipulate the agent's behavior.
[DYNAMIC_CONTEXT_INJECTION]: The SKILL.md file contains only documentation and usage examples. No dynamic context injection patterns (such as the !command`` syntax) are present.

narration-cut