The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts scripts/analyze_demo_pacing.py and scripts/probe_demo_media.py utilize the subprocess.run() function to execute the external utilities ffmpeg and ffprobe. These calls are implemented using a list of arguments rather than a single shell string, which is a secure practice that prevents command injection.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze data from external product repositories, including source code, documentation, and media assets. This represents an attack surface for indirect prompt injection; however, the skill includes explicit 'Autonomy boundary' instructions in SKILL.md that direct the agent to avoid recording sensitive data (tokens, account data, etc.) and to use sanitized fixtures.
[DATA_EXPOSURE]: The skill instructions proactively address data leakage by establishing rules against recording private information or unrelated application windows during the demo production process, prioritizing the use of synthetic data and repeatable starting states.

build-product-demo