The Agent Skills Directory

[SAFE]: The skill does not exhibit any malicious patterns such as data exfiltration, unauthorized file access, or obfuscation. It follows standard security practices for managing sensitive configuration.
[COMMAND_EXECUTION]: The skill uses subprocess calls to execute ffmpeg and a local helper script (scripts/assemble_video.sh). This is necessary for merging generated images and audio into the final video file. Commands are constructed using argument lists, which prevents shell injection vulnerabilities.
[EXTERNAL_DOWNLOADS]: The skill documentation correctly identifies dependencies on well-known libraries (openai, elevenlabs, pillow, requests) and system utilities (ffmpeg). These resources are from established and trusted sources.
[PROMPT_INJECTION]: The skill processes user-supplied story concepts to generate prompts for external AI services. While this represents an indirect prompt injection surface, the risk is low given the creative nature of the skill and the lack of access to sensitive system resources. Ingestion points: User-provided story concept and tone in SKILL.md. Boundary markers: Absent from the internal prompts. Capability inventory: File system writes, network requests, and media processing via subprocess. Sanitization: Not explicitly implemented, relying on service-provider safety filters.

video-storytelling