The Agent Skills Directory

Command Execution: The skill utilizes subprocess.run in its audio analysis script to invoke ffmpeg. This is a standard method for audio decoding and is implemented using a command list (non-shell mode), which is a safe practice that mitigates typical command injection vulnerabilities.
External Dependency Management: Instructions include the installation of well-known Python libraries (librosa, numpy, soundfile) and the use of the npx hyperframes CLI. These resources are from established registries and services and are necessary for the skill's media processing capabilities.
Input Sanitization: Several HTML templates include a robust sanitization mechanism for custom SVG icons. This logic uses an allow-list of tags and attributes to ensure that user-supplied or data-driven SVG content does not include harmful elements like scripts, which is a proactive security measure against potential injection attacks.
Local Asset Handling: The asset staging script restricts its operations to local files and enforces a strict whitelist of media extensions (e.g., .mp4, .png). This design ensures that only appropriate media types are processed and avoids the risks associated with fetching untrusted remote content.

music-to-video