The Agent Skills Directory

[DYNAMIC_EXECUTION]: The script scripts/beauty_glow_filter.py uses the eval() function to parse the frame rate output from ffprobe. Since this input is derived from the metadata of the video file being processed, a maliciously crafted file could potentially execute arbitrary Python code when the filter is applied.
[COMMAND_EXECUTION]: The skill makes extensive use of subprocess.run and subprocess.Popen across its workflows to manage AutoDL GPU instances and execute ffmpeg and ffprobe commands. While these calls typically use list-based arguments to mitigate basic shell injection, they still allow the skill to interact directly with the host system's shell environment using external inputs.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a vulnerability surface where malicious payloads could be embedded in the metadata of processed video files. The agent reads this metadata via ffprobe and passes it to the unsafe eval() call in beauty_glow_filter.py without sufficient validation or sanitization.
Ingestion points: The scripts/beauty_glow_filter.py script ingests metadata (frame rate) from user-provided or generated video files.
Boundary markers: None identified; the metadata is processed directly after extraction from ffprobe.
Capability inventory: Subprocess execution of system utilities (ffmpeg, ffprobe) and management of remote GPU instances via autodl_app.py.
Sanitization: Absent for the metadata string before it is passed to eval().

beauty-video-gen