The Agent Skills Directory

[COMMAND_EXECUTION]: The skill includes a Python script scripts/contact_sheet.py that executes shell commands to process video files. It invokes ffmpeg and ffprobe to extract frames and generate comparison videos.
Evidence: Found in scripts/contact_sheet.py, where a helper function run(args) wraps subprocess.run() to execute media tools (lines 27, 49, 57, 137).
Context: This is the primary intended purpose of the script (Quality Control for film production). The script uses list-based arguments for subprocess.run, which mitigates simple command injection but does not entirely eliminate risks from argument manipulation if malicious file paths are provided.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data, such as AI-generated video clips and project manifests, and performs sensitive operations like file writing and shell command execution based on that data.
Ingestion points: Reads material from project/media/raw/, project/screenplay/, and project/shot-list/ (referenced in SKILL.md).
Boundary markers: The skill does not implement specific boundary markers or instructions to ignore embedded prompts within the media metadata or project files it processes.
Capability inventory: The agent has the capability to write markdown reports and execute the contact_sheet.py script, which spawns system processes.
Sanitization: No explicit sanitization or validation of filenames or project data is performed before they are passed to shell execution or interpolated into reports.

creator-final-cut-editor