The Agent Skills Directory

[COMMAND_EXECUTION]: Several scripts, including probe.py, render.py, build_mix.py, qa.py, and transcribe.py, use the subprocess module to execute external binaries like ffmpeg, ffprobe, whisper-cli, and whisper-vad-speech-segments. The arguments for these commands are dynamically constructed based on user-provided configuration in hooks.json and intermediate processing files.
[EXTERNAL_DOWNLOADS]: The skill performs network operations to external services. transcribe.py uses curl to send audio data to OpenAI's transcription API (api.openai.com), and map_notes.py uses curl to fetch JSON data from a remote review platform at a here.now subdomain specified in the configuration.
[INDIRECT_PROMPT_INJECTION]: The map_notes.py script fetches reviewer comments from a remote API and prints them to the console to guide the next round of editing. This creates an indirect prompt injection surface where malicious instructions embedded in remote comments could attempt to influence the agent's subsequent actions.
[CREDENTIALS_UNSAFE]: The transcribe.py script contains logic to retrieve the OPENAI_API_KEY by searching through environment variables and scanning parent directories for .env files. While this facilitates local development, it explicitly grants the skill access to sensitive API credentials.

hook-splitter