The Agent Skills Directory

[DATA_EXFILTRATION]: Access to sensitive user configuration files.
Multiple scripts, including scripts/check_numbers.py, scripts/check_setup.sh, scripts/clone_voice.py, scripts/host.py, scripts/make_avatar.py, scripts/minimax_api.py, and scripts/tts.py, attempt to read the user's shell profile at ~/.zshrc to search for and extract API keys for Gemini, MiniMax, and fal.ai. Shell profile files are sensitive as they often contain environmental secrets, paths, and aliases beyond the specific keys sought.
[DYNAMIC_EXECUTION]: Runtime code loading and process replacement.
assets/huashu/clip.js uses eval() to dynamically execute JavaScript logic from files in the clips/ directory based on parameters in the provided specification.
scripts/render.js uses require('vm').runInNewContext() to execute code from palettes.js for theme resolution.
scripts/gen_bgm.py and scripts/mix_bgm.py use os.execvp() to replace the current process and re-execute themselves within a specific Python environment via uv run.
[COMMAND_EXECUTION]: Orchestration of system binaries with dynamic input.
The skill frequently invokes subprocess.run and subprocess.check_output to execute system tools such as ffmpeg, ffprobe, node, uv, and python3. These calls use arguments derived from project files (script.json, timeline.json), which presents a risk of command manipulation if those input files are not strictly validated.
[INDIRECT_PROMPT_INJECTION]: Attack surface for processing untrusted data.
Ingestion points: The skill ingests untrusted user data in the form of articles and scripts to be turned into videos (as described in SKILL.md).
Boundary markers: No explicit delimiters or instructions to ignore embedded commands were identified in the code that interpolates user text into prompts for external AI APIs.
Capability inventory: The skill has extensive command execution capabilities, file system writes (used in scripts/ref_frames.py and scripts/web_clip.py), and network access.
Sanitization: There is no evidence of sanitization or filtering of external content before it is processed by the agent's logic or passed to downstream execution tools.
[EXTERNAL_DOWNLOADS]: Dynamic resource acquisition from external sources.
scripts/check_setup.sh downloads and installs puppeteer-core from the NPM registry.
Several scripts download media content from dynamically generated URLs provided by external AI APIs (MiniMax and fal.ai). While these are recognized services, the mechanism involves executing downloads based on runtime API responses.

ray-explainer