The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes the subprocess module in scripts/analyze_material.py to invoke media analysis tools like ffmpeg and ffprobe. These calls pass arguments as lists rather than shell strings, which is a security best practice that prevents command injection via malformed user-provided file paths.
[EXTERNAL_DOWNLOADS]: The skill's workflow involves downloading images and gathering reference materials from the web. The implementation in scripts/image_generator.py includes validation logic to restrict downloads to HTTP/HTTPS protocols and enforces a 50MB file size limit to prevent potential abuse.
[DATA_EXFILTRATION]: To fulfill its purpose of image generation and content analysis, the skill transmits user-provided media and text prompts to an external AI service provider (OpenAI by default). This data flow is documented as part of the skill's core functionality and is necessary for its operation.
[PROMPT_INJECTION]: The skill processes external content, including user-supplied images and text files, which presents an indirect prompt injection surface. While this is an inherent risk in multi-modal AI processing, the skill does not contain instructions that attempt to bypass safety filters, and it relies on standard platform guardrails.

xhs-writer