The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill instructs the agent to load sensitive credentials from a local file, which exposes the environment to credential theft if the file is improperly secured.
Evidence: The instructions explicitly require an ELEVENLABS_API_KEY to be present in video-agent/.env and provide commands to load it into the shell environment.
[DYNAMIC_EXECUTION]: The skill uses the shell's sourcing command to execute the contents of a local environment file, which can lead to arbitrary code execution if the file's content is compromised.
Evidence: set -a; . video-agent/.env; set +a in SKILL.md directly executes the script inside the current shell process.
[COMMAND_EXECUTION]: The skill relies on extensive use of powerful shell utilities and sub-processes to manipulate and analyze media files.
Evidence: Frequent use of ffmpeg, ffprobe, yt-dlp, treg, and text processing tools like awk, grep, sort, and paste to measure video attributes and generate output.
[EXTERNAL_DOWNLOADS]: The skill fetches video and audio assets from various external sources, including social media platforms and third-party AI services.
Evidence: Uses yt-dlp to download content from YouTube, Instagram, and TikTok, and curl to interact with ElevenLabs APIs (api.elevenlabs.io) for audio isolation and sound generation.
[INDIRECT_PROMPT_INJECTION]: The skill has a significant attack surface for indirect prompt injection because it processes untrusted external video data and metadata.
Ingestion points: Video files are downloaded from user-provided URLs via yt-dlp and treg into the video-agent/.tmp/ directory.
Boundary markers: While URLs are quoted in shell commands, there are no instructions for the agent to sanitize or ignore malicious instructions that might be embedded in the video metadata or content itself.
Capability inventory: The skill utilizes Bash with access to ffmpeg, curl, and file system write operations, which could be exploited if malicious data influences the agent's actions.
Sanitization: No explicit sanitization or validation of the downloaded media files is performed before they are passed to analysis tools.
[METADATA_POISONING]: There is a manifest inconsistency between the declared tool restrictions and the actual behavior defined in the instructions.
Evidence: The YAML frontmatter lists a restricted set of allowed tools (yt-dlp, ffmpeg, ffprobe, treg catalog, treg balance), but the instructions utilize several additional commands such as curl, treg call, awk, grep, paste, and sort which are not explicitly permitted in the configuration.

steal