The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses subprocess.run to wrap FFmpeg and FFprobe for audio and video processing. All command arguments are passed as lists rather than strings, which is a standard security best practice that prevents shell-based command injection vulnerabilities. The operations are consistent with the skill's stated purpose as a media utility.
[INDIRECT_PROMPT_INJECTION]: The report_to_pdf.py script creates professional documents from Markdown input. This document generation capability represents an indirect prompt injection surface because an attacker could craft malicious input that manipulates the document's structure or styles.
Ingestion points: The utility reads Markdown files (via Path.read_text) and processes image paths found within the content.
Boundary markers: No specific boundary markers or instructions are included to prevent the agent from following directions embedded in processed Markdown files.
Capability inventory: The skill can perform file system writes (generating PDF and media outputs) and execute external media processing tools.
Sanitization: The script includes logic to embed local images as base64, which performs basic path existence checks but could be used to include sensitive local files in the output if the agent is directed to process a malicious file.
[EXTERNAL_DOWNLOADS]: The skill requires the third-party Python libraries markdown and weasyprint, as well as the system-level FFmpeg utility. It includes checks for these dependencies and provides instructions for installing them from official package registries and system repositories, which is standard for developer-oriented tools.

media-utils