The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes external video URLs and user-provided prompts, which creates a potential surface for indirect prompt injection if the video content or the prompt contains adversarial instructions.
Ingestion points: The videoUrl and prompt parameters used in functions throughout SKILL.md and scripts/video-understand.ts.
Boundary markers: The provided code examples do not implement specific delimiters or instructions to ignore embedded commands within the processed data.
Capability inventory: The skill's capabilities are limited to calling the z-ai-web-dev-sdk vision API. It does not perform shell command execution, direct file system writes, or unauthorized network operations.
Sanitization: While the documentation in SKILL.md explicitly recommends validating and sanitizing user inputs under the 'Security Considerations' section, the provided code snippets do not demonstrate these implementation details.

video-understand