The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The script publish-to-youtube.py accesses a sensitive YouTube OAuth token located at ~/.config/youtube/token.json. This credential allows the skill to perform actions on the user's YouTube account, such as uploading and deleting videos.
[COMMAND_EXECUTION]: The skill relies heavily on shell command execution. Scripts like tts.py, publish-to-youtube.py, and synth-sfx.sh use subprocess and bash to run ffmpeg, ffprobe, and python3. This provides a significant attack surface if input parameters are not correctly sanitized.
[EXTERNAL_DOWNLOADS]: The workflow involves npx hyperframes commands in SKILL.md, which dynamically fetch and execute code from the npm registry. While hyperframes is a known framework, runtime execution of remote packages introduces supply chain risks.
[INDIRECT_PROMPT_INJECTION]: The skill processes article.md, which is untrusted external data. This content is interpolated into templates for TTS and video generation without strict boundary markers or sanitization, potentially allowing embedded instructions to manipulate the video creation process.
Ingestion points: article.md (read by publish-to-youtube.py and tts.py).
Boundary markers: None identified in the workflow.
Capability inventory: File system write access, network access (YouTube, Volcano TTS), and shell command execution (ffmpeg, npx).
Sanitization: Limited stripping of markdown tags in specific fields, but not for the primary narration text.

wjs-converting-text-to-video