The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill downloads Whisper AI model files from HuggingFace, a well-known repository for machine learning assets.
Evidence in scripts/setup_captions.py: Downloads from https://huggingface.co/ggerganov/whisper.cpp/resolve/main/ggml-*.bin.
[COMMAND_EXECUTION]: The skill executes local system commands to perform video processing and dependency management.
Invokes ffmpeg and ffprobe for video analysis and rendering in scripts/make_short.py.
Uses brew install to install whisper-cpp and pip install for the Pillow library in scripts/setup_captions.py.
Arguments are passed as lists to subprocess.run, which follows best practices to prevent shell injection.
[METADATA_POISONING]: The skill contains hardcoded local file paths specific to the author's environment (/Users/francescomistero/) within the instructions and setup scripts.
While these paths may cause execution failures on other systems, they do not pose a direct security threat beyond disclosing the author's local username.
[INDIRECT_PROMPT_INJECTION]: The skill processes external video files and generates JSON reports based on the content.
Ingestion points: Video file paths and metadata extracted via ffprobe and silencedetect.
Boundary markers: None explicitly used for processed data.
Capability inventory: File system read/write, local command execution (ffmpeg, whisper-cli), and network downloads (models).
Sanitization: Shell commands use list-based arguments rather than string interpolation, mitigating typical command injection vectors.

video-short-maker