The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill interacts with the official TMDb API (api.themoviedb.org) to retrieve film and television metadata. TMDb is a well-known service, and the network operations are limited to the intended functionality of the skill.
[CREDENTIALS_UNSAFE]: The skill follows security best practices by instructing users to manage credentials via environment variables (TMDB_ACCESS_TOKEN or TMDB_API_KEY). No hardcoded secrets were found in the codebase, and the test scripts explicitly strip environment variables to prevent accidental exposure.
[COMMAND_EXECUTION]: The use of subprocess.run in scripts/test_tmdb.py is limited to executing the local tmdb CLI script for verification purposes. It does not use shell=True and does not process untrusted user input, making it safe for its context within the test suite.
[INDIRECT_PROMPT_INJECTION]: The skill ingests community-sourced metadata from the TMDb API. While this represents a theoretical ingestion point for untrusted data, the skill lacks high-privilege capabilities (such as file writing or arbitrary command execution) that could be exploited. The surface is consistent with the primary purpose of the skill.
Ingestion points: scripts/tmdb (via TMDBClient._get fetching from api.themoviedb.org)
Boundary markers: Absent (standard interpolation of JSON results)
Capability inventory: Network requests via requests.get to api.themoviedb.org (scripts/tmdb)
Sanitization: Standard JSON parsing (scripts/tmdb)

tmdb