The Agent Skills Directory

[DYNAMIC_EXECUTION]: The script scripts/frame_video.py uses the eval() function to parse the r_frame_rate property from video metadata returned by ffprobe. This is a significant security risk as a maliciously crafted video file could provide a string that, when evaluated, executes arbitrary Python code in the context of the agent.
[COMMAND_EXECUTION]: The skill relies on executing external system commands (ffmpeg and ffprobe) via subprocess.run to process video files. While the script passes arguments as a list to prevent basic shell injection, the interaction with complex media processing tools and the reliance on their output for further processing introduces a significant attack surface.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to process external, untrusted user data (images and videos) and incorporate them into complex processing pipelines, creating a vulnerability surface for indirect injection attacks.
Ingestion points: User-provided files are passed to scripts/frame_video.py via the input command-line argument.
Boundary markers: Absent. The script does not implement safety boundaries or "ignore instructions" markers when handling file metadata or content.
Capability inventory: The script has the capability to execute shell commands (ffmpeg, ffprobe) and perform file system write operations.
Sanitization: The script performs minimal validation or sanitization of the input metadata before passing it to the eval() function or external commands.

device-framer