The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts/bootstrap-host.sh, scripts/bootstrap-host.ps1, and scripts/setup-host.mjs files execute system-level commands to check for and install Node.js, Python, and other media tools required for the skill to function.
[PRIVILEGE_ESCALATION]: The scripts/bootstrap-host.sh script utilizes sudo to run apt-get commands for installing system dependencies on Linux. This requires administrative privileges and, while the script is interactive and asks for user confirmation, it performs high-privilege operations.
[DYNAMIC_EXECUTION]: The Python script scripts/analyze_replication.py uses subprocess.check_output() to execute ffmpeg and ffprobe for analyzing audio and video files. This is a core part of the skill's media processing functionality.
[EXTERNAL_DOWNLOADS]: The skill downloads AI models for voiceover and depth analysis from external repositories such as Hugging Face (haixin/timeline-studio-voice-models) and ModelScope (martindelophy/timeline-studio-voice-models). These models are pinned to specific commit hashes to ensure integrity, but represent external dependencies.
[OBFUSCATION]: The README.md file contains a shortened URL (https://shorturl.at/ggSqS) for a community badge. Shortened URLs mask the final destination, which is a common obfuscation technique, although here it appears to be used for a legitimate community forum link.
[INDIRECT_PROMPT_INJECTION]: The skill processes and analyzes external video and image content for transcription, OCR, and scene detection. This creates an attack surface where malicious instructions could be embedded in the processed media to influence the agent's behavior.
Ingestion points: Video and audio files are read using opencv-python and processed via ffmpeg in scripts/analyze_replication.py, with transcripts being inspected via transcript.inspect.
Boundary markers: No explicit sanitization or delimiters for content extracted from media files were identified in the automated analysis scripts.
Capability inventory: The skill possesses broad capabilities including file writing, network access for model downloads, and shell command execution.
Sanitization: While the skill provides detailed workflow instructions for the agent, the underlying analysis scripts do not implement automated sanitization of data extracted from media metadata or content.

edit-timeline-studio