The Agent Skills Directory

[DYNAMIC_EXECUTION]: The script scripts/generate_storyboard.py dynamically modifies the Python sys.path at runtime to import local utilities and engines from relative paths derived from the script's own location.
Evidence: It uses sys.path.insert(0, ...) to include directories such as tools and tools/ugc/engines located three levels up from the script file.
Evidence: The import of bootcamp_utils, credential_manager, and the kling engine occurs through these computed paths.
[INDIRECT_PROMPT_INJECTION]: The skill constructs prompts for the Gemini API by directly interpolating untrusted user input from command-line arguments, creating a vulnerability surface for indirect prompt injection.
Ingestion points: The --scenario and --character arguments in scripts/generate_storyboard.py are used to populate prompts for scene decomposition and image generation.
Boundary markers: The prompt templates lack clear delimiters or specific instructions to the model to treat the interpolated text as data only, which could allow a malicious user to override intended behavior via carefully crafted scenario text.
Capability inventory: The skill has the ability to write files (images, JSON, and video) to the local filesystem and performs network operations to reach AI model APIs.
Sanitization: There is no evidence of input validation, escaping, or filtering of the user-provided scenario or character descriptions before they are embedded into the prompts.

storyboard-generator