The Agent Skills Directory

[CREDENTIALS_SAFE]: The skill manages numerous sensitive API keys (OpenAI, Anthropic, Fal, etc.) with a high degree of security.
Evidence: scripts/reels_online.py stores keys in ~/.config/it-reelsmaker/keys.env using restrictive file permissions (mode 0600).
Evidence: A global scrub() function is implemented and used to redact all secret values from error messages and output text before they are displayed or logged.
Evidence: The SafeRedirect class in scripts/reels_online.py ensures that sensitive authorization headers are stripped if a network request is redirected to a different origin.
[COMMAND_EXECUTION]: The skill executes system commands for media processing and remote connectivity.
Evidence: scripts/matte_server.py uses subprocess to call ssh, scp, and tar for remote figure cut-outs.
Evidence: scripts/transcribe_online.py uses ffmpeg for audio re-encoding.
Evidence: All shell arguments are sanitized using shlex.quote(), and the remote SSH host is validated against a strict regex to prevent command injection.
[EXTERNAL_DOWNLOADS]: The skill fetches footage and assets from established providers.
Evidence: Downloads video clips from Pexels, Pixabay, and Openverse using HTTPS.
Evidence: All paid operations (generation and transcription) and large downloads require explicit user approval (the --yes flag) and check for a global REELS_OFFLINE flag.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from external providers (stock metadata, AI transcripts, and translations), presenting a potential attack surface.
Ingestion points: Video transcripts from OpenAI/Groq, translation results from Anthropic/Gemini, and search metadata from stock/meme sites.
Boundary markers: The skill does not use explicit boundary delimiters, but relies on structured prompt templates to process external strings.
Capability inventory: High-privilege capabilities include SSH command execution, file system modification, and broad network access.
Sanitization: All output is passed through a scrubbing filter to prevent credential leakage; shell commands are quoted to prevent escape.

it-reelsmaker-online