The Agent Skills Directory

[SAFE]: The skill integrates with established and well-known stock video providers including Pexels, Pixabay, and Coverr for asset retrieval. The network operations are limited to these official API endpoints and follow their documented security and rate-limiting protocols.
[COMMAND_EXECUTION]: The scripts/sucai.mjs utility executes ffmpeg and ffprobe via spawnSync to process media files. Security is maintained by sanitizing filenames using a safeName regex pattern (/[^a-zA-Z0-9_-]+/g) and ensuring that dynamic arguments like durations are explicitly cast to numeric types before being passed to the shell.
[CREDENTIALS_UNSAFE]: The skill implements standard secret management by utilizing environment variables and a .env file loader. It provides a .env.example template without hardcoded keys, ensuring that sensitive API tokens are kept out of the codebase and version control.
[INDIRECT_PROMPT_INJECTION]: The skill processes external data from a source-manifest.json file to generate search queries and identify required assets. The implementation mitigates injection risks by strictly scoping tool capabilities to stock media search and using structured manifest validation to ensure input integrity before processing.

laohan-sucai