The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes local system utilities including ffprobe for extracting video metadata, and osascript, say, and afplay for delivering system notifications and audio alerts to the user.
[EXTERNAL_DOWNLOADS]: The skill interacts with the ByteDance (Volcengine) official API (openspeech.bytedance.com) to generate text-to-speech audio for user notifications. This uses a well-known service for its intended functional purpose.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from platform pages (such as existing video descriptions or metadata) which could potentially contain malicious instructions. This risk is effectively mitigated by the skill's mandatory awaiting_confirmation design, which requires a human user to review and approve the final fields before the publish command is executed.
[DYNAMIC_EXECUTION]: In scripts/notify_user.py, the skill generates a small Python script string at runtime and executes it via subprocess.Popen([sys.executable, "-c", ...]). This is used to handle asynchronous background audio playback and ensure temporary file cleanup, representing a common utility pattern rather than a malicious execution vector.

lov-media-publisher