The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses the ffmpeg binary to perform video processing tasks such as audio extraction, silence detection, and video concatenation. These operations are executed using subprocess.run with argument lists, which is a secure way to handle external commands.
Evidence: Subprocess calls found in scripts/pipeline.py within split_video_to_scenes, trim_silence, _extract_last_frame, and generate_video_pipeline functions.
Mitigations: The skill uses list-based arguments instead of shell strings and allows the ffmpeg path to be configured via environment variables.
[PROMPT_INJECTION]: Contains an indirect prompt injection surface where user-provided video topics or analyzed reference content are interpolated into downstream prompts for the Veo video generation model.
Ingestion points: User input topic in scripts/app.py and reference video analysis in scripts/pipeline.py.
Boundary markers: The skill relies on structured JSON output from Gemini to define scenes, but does not use explicit delimiters to isolate user-controlled visual descriptions in the final Veo generation prompts.
Capability inventory: The agent has the ability to execute file system operations (saving clips) and network operations (Vertex AI API calls).
Sanitization: No explicit filtering or sanitization of the user-provided topic is performed before it is sent to the LLM.

clawcut