The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses subprocess.run() extensively to interface with FFmpeg and FFprobe. These calls are constructed using argument lists or with shlex.quote() to mitigate shell injection risks. The skill includes a runtime_preflight.py script to verify toolchain capabilities and an edit_preflight.py to validate rendering configurations before execution. All execution is performed locally on project-bound assets.
[DATA_EXFILTRATION]: No evidence of unauthorized data transfer was found. Network activity is limited to well-known generation provider APIs (e.g., OpenAI, Dreamina) and is mediated by an explicit authorization gate (production_authorization.py) that requires human review of the exact production scope and cost.
[INDIRECT_PROMPT_INJECTION]: The skill processes potentially untrusted content such as ASR transcripts and external project files. It employs specific escaping functions for FFmpeg's drawtext and ass filters to prevent injection attacks through malicious subtitles. A content_guard.py script serves as a linter to ensure that generated content complies with platform safety guidelines, blocking deceptive or prohibited wording.
[PRIVILEGE_ESCALATION]: The skill does not attempt to gain elevated privileges. It uses a strict blocklist in edit_revision.py to prevent any modifications to the skill's own scripts, project documents, or sensitive system directories, ensuring that the AI agent cannot modify its own instructions.
[DYNAMIC_EXECUTION]: The skill uses complex JSON artifacts to drive video rendering but does not employ dangerous functions like eval() or exec() on untrusted data. Render decisions are recorded in auditable manifests and verified against live file fingerprints using SHA-256 digests.

video-editing