The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes subprocess.run to call external command-line tools such as whisperx and ffmpeg in SKILL.md. These calls include user-provided file paths and configuration parameters. Although the script uses list-based argument passing to mitigate shell injection, it executes system-level commands based on external input. The code also facilitates passing a sensitive Hugging Face token as a command-line argument, which may be visible in process listings on some systems.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to process external, untrusted data which presents a surface for indirect prompt injection.
Ingestion points: Processes audio/video files via audio_path and video_path and handles transcript text in the QuoteBank class (SKILL.md).
Boundary markers: No specific delimiters or instructions are provided to the agent to ignore potentially malicious content embedded in transcripts or file metadata.
Capability inventory: The skill possesses file system access (open, Path.mkdir, Path.glob) and command execution capabilities (subprocess.run) (SKILL.md).
Sanitization: Employs re.escape for timestamp-based regex search but lacks validation or sanitization for input paths and transcript content before further processing or command execution.
[EXTERNAL_DOWNLOADS]: The skill refers to external resources including the whisperx GitHub repository (m-bain/whisperX) and fetches models from Hugging Face (huggingface.co), a well-known service, to perform diarization tasks.

interview-transcription