The Agent Skills Directory

[COMMAND_EXECUTION]: The skill makes extensive use of ffmpeg and ffprobe to manipulate video segments, merge audio, and extract media metadata. All commands are executed via subprocess.run using list-based arguments, which effectively prevents shell injection vulnerabilities. No instances of shell=True with unvalidated user input were found.
[DATA_EXFILTRATION]: Network activity is restricted to local communication with a TTS daemon (defaulting to localhost:7860). This is used solely to transmit text for conversion into audio files. No exfiltration of sensitive files (SSH keys, cloud credentials, or environment variables) was detected.
[EXTERNAL_DOWNLOADS]: The skill utilizes standard, well-known libraries such as numpy, opencv-python (cv2), and pyyaml. The tts.py script uses urllib.request.urlopen to retrieve audio data from a configured local endpoint. This behavior is a standard part of the skill's media generation workflow and does not involve the execution of untrusted remote code.
[DYNAMIC_EXECUTION]: The skill dynamically generates HTML templates to render comic panels and titles. This process includes appropriate sanitization using html.escape to prevent injection attacks during the rendering phase. There is no usage of dangerous dynamic execution functions like eval() or exec() on untrusted data.

inemaref-motioncomic