The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The scripts scripts/remove-background.sh and scripts/batch-remove-background.sh include logic to automatically install the rmbg-cli package globally via npm install -g rmbg-cli if the command is not present. This installs software from an untrusted third-party source at runtime without user intervention.
[REMOTE_CODE_EXECUTION]: The automated installation of rmbg-cli effectively downloads and prepares code for execution from the public NPM registry. Since this package is not from a recognized trusted vendor or well-known service, it represents a potential supply-chain risk where unverified code could be executed.
[COMMAND_EXECUTION]: The skill relies heavily on executing system binaries (ffmpeg, magick, rmbg) through subprocess.run in Python and shell scripts. While these are necessary for the skill's functionality, they provide a broad surface for command-line interactions.
[PROMPT_INJECTION]: The skill processes media files and extracts metadata via ffprobe and identify. It is susceptible to indirect prompt injection where malicious filenames (e.g., containing newlines or shell metacharacters) or metadata fields could be used to influence the agent's behavior or exploit vulnerabilities in the script's handling of external input.

media-processing