The Agent Skills Directory

[COMMAND_EXECUTION]: The script is vulnerable to command injection because it interpolates the unsanitized --video CLI argument directly into shell commands executed via execSync.
Evidence: In wan-video-clone.js, the ffprobe and ffmpeg commands in functions like getVideoDuration, splitVideo, and extractFrame use template literals to insert the videoInput or resulting paths into shell strings.
[EXTERNAL_DOWNLOADS]: The skill downloads content from arbitrary user-supplied URLs.
Evidence: The downloadFile function fetches the URL provided in the --video flag without domain restriction or validation.
[CREDENTIALS_UNSAFE]: The skill explicitly disables TLS certificate validation, creating a high risk of credential theft through Man-in-the-Middle (MitM) attacks.
Evidence: process.env.NODE_TLS_REJECT_UNAUTHORIZED = "0" is set at the top of wan-video-clone.js. This allows an attacker to intercept network traffic and steal the FAL_KEY or REPLICATE_API_TOKEN which are sent in plaintext headers over the compromised connection.

wan-video-clone