The Agent Skills Directory

[COMMAND_EXECUTION]: The entry point script scripts/run.py uses os.execv to re-execute itself within a local virtual environment. This is a standard pattern for ensuring the script runs with the intended Python interpreter and dependencies.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a vulnerability surface where untrusted data from subtitle files is processed and incorporated into shell commands.
Ingestion points: User-provided SRT, VTT, and TXT files parsed in the pipeline described in SKILL.md and references/subtitle-formats.md.
Boundary markers: None identified; individual text cues are processed as string literals for the video filter.
Capability inventory: The skill executes ffmpeg and ffprobe as subprocesses to render captions and detect video duration.
Sanitization: Partial; the documentation in references/troubleshoot.md acknowledges that escaping for special characters in the ffmpeg drawtext filter is incomplete, potentially leading to command malformation if malicious content is provided in a subtitle file.
[EXTERNAL_DOWNLOADS]: The documentation provides instructions for installing the ffmpeg dependency via system package managers like brew and apt-get. It also includes an example curl command targeting the OpenAI API for transcription, which is provided for informational purposes.

subtitle-burner