The Agent Skills Directory

[DYNAMIC_EXECUTION]: The script scripts/mp-mediaserver.py uses importlib.import_module() to dynamically load provider classes (e.g., Emby, Plex, Jellyfin).
Evidence: The _import_symbol function performs the dynamic import.
Mitigation: The module paths are retrieved from a static, hardcoded PROVIDER_CLASSES dictionary. The selection of which module to load is limited to a predefined set of supported providers, preventing arbitrary code loading from untrusted inputs.
[DATA_EXPOSURE]: The skill is designed to interact with media server APIs using local credentials stored in the MoviePilot environment.
Evidence: The script includes a _jsonable function and a _is_sensitive_key helper that identifies and removes sensitive fields such as password, token, apikey, and sessionid before returning any data to the AI agent.
Best Practice: The SKILL.md explicitly instructs the agent never to request or print hostnames, passwords, or API keys, relying on the script to handle authentication internally.

mediaserver-operation