The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts scripts/analyze_demo_pacing.py and scripts/probe_demo_media.py utilize subprocess.run to call ffmpeg and ffprobe. These calls are implemented using list-based argument passing, which protects against shell injection. This behavior is the intended and necessary functionality for media analysis and verification.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from product repositories, media files, and beat-plan.json artifacts. The vulnerability surface is mitigated by including a dedicated validation script (validate_demo_plan.py) and providing clear instructions in SKILL.md to establish truth boundaries and disclose the use of deterministic fixtures. The ingestion points include the beat plan and media paths, while capabilities are limited to local file analysis and metadata probing.

build-product-demo