The Agent Skills Directory

[DYNAMIC_EXECUTION]: The implementation of importlib.import_module within scripts/check_moviepy.py is used to check for the availability of the moviepy and Pillow libraries. This is a benign use of dynamic loading for environment verification, as the module names are hardcoded and not derived from untrusted input.
[INDIRECT_PROMPT_INJECTION]: The skill ingests user-provided text and local media assets to generate video overlays. While this represents a data ingestion surface, the risk is mitigated because the processed data is rendered into a visual output format and is not fed back into the agent's decision-making or instruction context. Additionally, the script uses SHA-1 hashing of the input parameters to generate cache filenames, which prevents path traversal or file-system-based injection via the overlay text.
[COMMAND_EXECUTION]: The skill detects missing dependencies and provides the user with the necessary pip installation command. Explicit instructions in SKILL.md and evals/evals.json strictly prohibit the agent from executing these environment changes without manual user confirmation, ensuring that the agent does not perform autonomous privilege escalation or unauthorized software installation.

modellix-moviepy