The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts cut.py and speech.py use the subprocess.run function with argument lists to execute system commands such as ffmpeg and ffprobe. This implementation avoids using a shell, which effectively prevents command injection vulnerabilities from untrusted file names or metadata.
[EXTERNAL_DOWNLOADS]: The speech.py script includes functionality to download pre-trained speech-to-text models from Hugging Face if they are not already cached. These operations target a well-known technology platform and are consistent with the skill's primary purpose of providing AI-powered transcription.
[DYNAMIC_EXECUTION]: The skill's main script uses a dynamic dispatch mechanism to call internal functions based on command-line arguments. This pattern is restricted to the specific subcommands defined within the script's argparse configuration, posing no security risk from arbitrary code execution.
[INDIRECT_PROMPT_INJECTION]: The skill processes external data such as subtitle files (SRT) and transcription drafts. While this represents a potential ingestion point for untrusted content, the data is treated as parameters for media processing tasks rather than instructions for the agent, and the script's architecture prevents this data from influencing shell execution.

ajiang-koubo-cut