The Agent Skills Directory

[COMMAND_EXECUTION]: The provided Python script utilizes subprocess.Popen to call ffmpeg and ffprobe for validating the integrity of source images and generated video files. These calls are wrapped in a defensive bounded_process function that enforces strict timeouts and output buffer limits to mitigate potential resource exhaustion attacks from malformed media metadata.
[DATA_EXFILTRATION]: The skill implements advanced network security controls for downloading generated content. It requires a human-reviewed allowlist of exact DNS hostnames, explicitly rejects IP literals, verifies that hosts resolve to public IP addresses, and employs DNS pinning with TLS SNI validation. Additionally, the script is designed to redact sensitive information like Base64 media data and signed URLs from its logs, using SHA-256 hashes for provenance instead.
[CREDENTIALS_UNSAFE]: The skill follows security best practices for credential management by requiring API keys to be provided through environment variables. The instructions explicitly warn against hardcoding secrets or exposing them in logs or chat interfaces.
[INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied text prompts and images. To mitigate risks associated with malicious data ingestion, the workflow requires an explicit "dry-run" phase where a request dossier is generated and hashed. A human operator must approve this hash, which binds the specific prompt, model parameters, and source media to a finite cost ceiling before any network request is initiated.

minimax-hailuo-video