The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied prompt strings and external media URLs to generate video content, which constitutes an indirect prompt injection attack surface.
Ingestion points: The script reads RUNWAY_PROMPT from the environment and takes media URIs (images/videos) from source plans.
Capability inventory: The skill possesses file write capabilities (ledger and artifact storage), network access (communicating with the Runway API and downloading media), and subprocess execution capabilities (using media tools).
Boundary markers: The skill requires an "Exact paid approval" step where a human must review the full request envelope and provide a SHA-256 hash matching the plan before execution.
Sanitization: Inputs are rigorously validated; media files are hashed with SHA-256, and external URLs are subjected to strict SSRF controls including exact-host allowlisting and DNS pinning.
[COMMAND_EXECUTION]: The provided Python implementation uses system tools to perform deep validation of media assets.
Evidence: The runway_video.py script invokes ffprobe and ffmpeg via subprocess.Popen to verify containers, streams, and perform full decodes of generated content.
Risk Mitigation: Executables are hardcoded and invoked only against local file paths that have been previously hashed and validated, minimizing the risk of arbitrary command injection.
[EXTERNAL_DOWNLOADS]: The skill fetches generated video assets from Runway's infrastructure to move them to durable storage.
Details: The download_mp4 function performs authenticated downloads from the Runway API outputs.
Risk Mitigation: The implementation uses a PinnedHTTPSConnection to prevent DNS rebinding attacks and enforces an exact-host allowlist to ensure downloads only occur from approved infrastructure.

runway-video