The Agent Skills Directory

[Remote Code Execution Considerations]: The shell and PowerShell wrappers (scripts/assemble-video.sh and scripts/Invoke-AssembleVideo.ps1) check for the presence of the 'uv' package manager. If not found, they provide or suggest the use of an installation command (curl -LsSf https://astral.sh/uv/install.sh | sh). While downloading and piping scripts to a shell is a sensitive operation, this specific pattern targets the official installer for a well-known and widely used developer tool.
[Command Execution via Subprocess]: The core logic in scripts/assemble_video.py uses subprocess.run to invoke the ffmpeg and ffprobe command-line tools. These calls are implemented using list-based arguments rather than shell strings (e.g., subprocess.run(command, ...) where command is a list), which is a recommended security practice to prevent command injection. The skill resolves and validates file paths before passing them to these tools.
[Indirect Prompt Injection Surface]: The skill processes external data via a YAML manifest (segments.yml). An attacker who can control the content of this manifest could potentially influence the parameters passed to FFmpeg. However, the skill implements strict schema validation and file existence checks in assemble_video.py to mitigate risks associated with untrusted input.

demo-video