The Agent Skills Directory

[COMMAND_EXECUTION]: The skill makes extensive use of the system's media processing tools. Multiple scripts (scripts/build.py, scripts/tighten.py, scripts/freespace.py, etc.) invoke ffmpeg and ffprobe via subprocess.run to render video, analyze waveforms, and transcode clips. These operations are core to the skill's functionality as a video editor.
[EXTERNAL_DOWNLOADS]: The script scripts/arcads_gen.py interacts with the Arcads external API (external-api.arcads.ai) to generate and download video assets. Additionally, scripts/transcribe-shots.ts and scripts/qa/verify_cuts.ts send audio data to OpenAI for transcription services. These network operations are clearly documented and essential for the intended AI-assisted editing workflow.
[INDIRECT_PROMPT_INJECTION]: The skill exhibits an indirect injection surface because it ingests untrusted data from user-provided video takes and timeline notes. Specifically, scripts/transcribe-shots.ts transcribes user audio, and the resulting text is used to generate on-screen captions and influence editing logic. While this presents a surface where malicious instructions could be embedded in audio, the risk is mitigated by the highly structured nature of the EDL (Edit Decision List) and script templates used for production.
[DYNAMIC_EXECUTION]: The scripts/build-comp.mjs script dynamically generates an HTML/JavaScript composition based on audio transcripts and EDL data. This generated content is used by the hyperframes renderer to produce motion graphics. The script includes basic HTML escaping (esc function) to prevent injection during the generation of text elements.
[CREDENTIALS_SAFE]: The skill implements standard best practices for secret management by loading API keys (Arcads, OpenAI, ElevenLabs) from environment variables or .env files rather than hardcoding them.

arcads-video-edit