The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute a shell command using a local Python script tools/gen_thumbnail.py located within a virtual environment. The command includes several arguments derived from the project state and user input.
Evidence: venv/Scripts/python tools/gen_thumbnail.py --prompt-file videos/<p>/packaging/thumbs/<X>.txt --out videos/<p>/packaging/thumbs/<X>.png --jpg --seed <N>
[INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface for indirect injection as it ingests data from a 'locked title' (generated by separate packaging logic) and user-supplied 'hook text'. These inputs are interpolated into prompt files and used to determine file paths for the rendering tool.
Ingestion points: Project directory variables (<p>, <X>), 'locked title' from preceding /packaging stage, and user-provided text for 'hook', 'sticker', and 'checkstrip' elements.
Boundary markers: The skill lacks technical sanitization for the project/file variables used in shell commands, though it does instruct the agent to echo the words back to the user before rendering.
Capability inventory: The skill uses venv/Scripts/python to run a script, reads face libraries, and writes multiple files (.txt, .png, .jpg) to the filesystem.
Sanitization: No explicit sanitization or escaping logic is described for the interpolation of user-supplied text into the shell command arguments or prompt files.

youtube-thumbnail