The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The file SKILL.md contains an explicit instruction to the agent: 'Always run this skill in escalation permission mode.' This is a directive to bypass standard security boundaries and run with elevated privileges without providing a clear technical justification for why such permissions are required for OCR tasks.
[DATA_EXFILTRATION]: The script scripts/video_feed_ocr.py contains hardcoded local network IP addresses (192.168.1.161). The function run_ocr_llm transmits Base64-encoded video frame data to http://192.168.1.161:1234/v1/chat/completions. This behavior constitutes a data exfiltration risk, as sensitive visual information from the user's video files is sent to an unverified machine on the local network.
[COMMAND_EXECUTION]: The skill relies on executing system-level binaries (ffmpeg, tesseract, and which) using subprocess.run. While the script uses list-based arguments to mitigate shell injection, the requirement for these tools and the use of subprocesses increase the attack surface if the binaries or the input paths are compromised.
[INDIRECT_PROMPT_INJECTION]: The skill processes video files to extract text via OCR and writes the results to ocr_raw.txt. This creates an attack surface where malicious text embedded in a video (e.g., hidden instructions or jailbreak attempts) could be ingested by the agent.
Ingestion points: Video frames processed in scripts/video_feed_ocr.py and saved as text files.
Boundary markers: None identified in the output files or prompt construction.
Capability inventory: The skill possesses file-write capabilities, network access (to hardcoded IPs), and subprocess execution.
Sanitization: There is no evidence of sanitization or filtering of the text extracted from the video before it is presented to the agent context.

video-feed-ocr