The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill downloads and installs the 'uv' package manager from its official domain (astral.sh) and clones craft reference repositories from the Shanyin-ai organization on GitHub. These are recognized as well-known technology services and are intended for the skill's setup.
[REMOTE_CODE_EXECUTION]: The doctor.sh script suggests a command to install the uv tool by piping a remote script directly into the shell (curl | sh). Additionally, render_shot.py dynamically loads provider modules using importlib.import_module based on configuration values, which constitutes dynamic execution from computed paths.
[COMMAND_EXECUTION]: Numerous scripts, including render_shot.py, render_all.py, stitch.py, and helpers in lib/ffmpeg_helpers.py, use subprocess.run to execute system binaries such as ffmpeg and ffprobe, as well as to coordinate internal Python script execution.
[PROMPT_INJECTION]: The skill has an indirect prompt injection attack surface (Category 8). It processes untrusted story ideas (premises) and model-generated critiques to autonomously generate or rewrite video prompts.
Ingestion points: Story premises are stored in initialPrompt.md/premise.md and critiques are read from reviews/*.json.
Boundary markers: Explicit delimiters for external content are generally absent in the prompt construction logic.
Capability inventory: The skill can execute shell commands via subprocess.run, write files, and perform network API calls through the Bailian (bl) CLI.
Sanitization: There is no evidence of automated sanitization; the agent is expected to handle the input creatively.

spark-video-episode