The Agent Skills Directory

[COMMAND_EXECUTION]: The skill makes extensive use of subprocess.run to call system binaries including ffmpeg, ffprobe, whisper-cli, and curl. While these calls use list-based arguments to prevent simple shell injection, the scripts dynamically construct complex command strings and filter graphs based on configuration files and media analysis.
Evidence found in scripts/_cfg.py, scripts/render.py, scripts/build_mix.py, and scripts/probe.py.
[CREDENTIALS_UNSAFE]: The scripts/transcribe.py file contains logic that searches for an .env file containing an OPENAI_API_KEY by traversing up the directory tree up to six levels. This proactive search for credentials outside the immediate skill directory could lead to unintended access to secrets in parent or sibling project directories if the execution environment lacks strict isolation.
[EXTERNAL_DOWNLOADS]: The script scripts/map_notes.py uses curl to fetch JSON data from a remote endpoint (here.now) to retrieve reviewer comments. Additionally, scripts/transcribe.py transmits audio recordings to the OpenAI API for transcription.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted reviewer comments from an external URL in scripts/map_notes.py and prints them into the agent's console output to help map notes to source timestamps. This creates a surface for indirect prompt injection where a malicious reviewer could embed instructions aimed at the AI agent.
Ingestion points: scripts/map_notes.py via curl from https://{slug}.here.now/.herenow/data/comments.
Boundary markers: None identified; the external text is printed directly into the agent's context.
Capability inventory: The skill has significant capabilities including file system modification, command execution (FFmpeg, Whisper), and network access (OpenAI, here.now).
Sanitization: None; external strings are parsed from JSON and displayed verbatim.

hook-splitter