The Agent Skills Directory

[COMMAND_EXECUTION]: The skill operates by generating and executing shell commands for ffmpeg and ffprobe to perform video manipulation tasks.
[PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection (Category 8) due to the lack of filename sanitization.
Ingestion points: Filenames and file metadata retrieved from the local file system (referenced in SKILL.md and references/operations.md).
Boundary markers: Absent. The instructions do not provide delimiters or warnings to the agent regarding the processing of untrusted filenames.
Capability inventory: Shell command execution (ffmpeg, ffprobe, printf) and file write operations (redirection to list.txt).
Sanitization: Absent. Filenames are interpolated directly into shell strings without escaping or validation.
[COMMAND_EXECUTION]: The video concatenation recipe uses the -safe 0 flag with the concat demuxer. This configuration allows ffmpeg to process absolute paths and various protocols within the input list, which could lead to unauthorized file access if an attacker influences the filenames used to generate the list.
[COMMAND_EXECUTION]: The skill documentation includes sudo apt install commands for environment setup. While standard for dependency management, these commands involve elevated privileges.

video-edit