The Agent Skills Directory

[PROMPT_INJECTION]: Indirect Prompt Injection Surface.\n
Ingestion points: The script scripts/analyze_riffrec_zip.py processes data from user-supplied feedback sources, including ZIP archives (containing JSON metadata and media), standalone media files, and meeting notes.\n
Boundary markers: Data is delimited using XML-style tags such as <discussion_transcript>, <video_frames>, and <analysis> within generated markdown artifacts like review-prompt.md and problem-analysis.md.\n
Capability inventory: The skill performs file system operations and executes shell commands via subprocess.run (ffmpeg, curl) and is designed to feed data into the ce-brainstorm skill.\n
Sanitization: No explicit sanitization or escaping is applied to the transcribed text or notes before they are interpolated into the prompt templates, creating a risk that malicious content in feedback could manipulate the agent.\n- [COMMAND_EXECUTION]: Local Media Processing. The analysis script invokes ffmpeg and ffprobe to analyze media files and extract frames. These operations use the subprocess list format, which avoids shell interpolation and adheres to security best practices for executing local binaries.\n- [EXTERNAL_DOWNLOADS]: Transcription via OpenAI API. The skill uses curl to send audio data to api.openai.com for transcription. This is a standard use of a well-known service to fulfill the skill's primary functionality.

ce-riffrec-feedback-analysis