The Agent Skills Directory

Secure Command Execution: The skill executes local ffmpeg and ffprobe commands using array-based argument passing (e.g., PowerShell's ArgumentList and Bash's array expansion). This approach ensures that user-supplied filenames or parameters cannot be interpreted as shell commands, effectively mitigating shell injection risks.
Strict Input Validation: All numeric parameters (such as --fps and --width) and algorithmic selections (such as --dither and --tonemap) are validated against predefined ranges or allow-lists before they are used to build FFmpeg filtergraphs. This prevents filtergraph injection attacks where a malicious parameter could alter the tool's behavior.
Resource and Availability Protections: Each external tool invocation is wrapped in a wall-clock timeout mechanism (using timeout in Bash or .NET process timers in PowerShell). This prevents the agent or host system from hanging indefinitely if it encounters a malformed or computationally expensive video file.
Temporary File Security: The skill generates intermediate palette files in private, unpredictable temporary directories with restricted permissions. This practice protects against local symlink attacks and race conditions that can occur in shared temporary locations.
Trusted Dependency Guidance: The skill documentation recommends installing FFmpeg through well-known, official package managers like Homebrew, APT, Chocolatey, and winget, which are recognized as safe sources for system utilities.
Indirect Prompt Injection Surface: The skill processes external video files and extracts metadata via ffprobe. While this creates an indirect injection surface, the skill mitigates risk by only reading specific color metadata and validating the results against expected patterns before further processing.

video-to-gif