The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes subprocess.run to invoke ffmpeg and ffprobe for media processing tasks such as frame extraction, metadata probing, and video encoding across several scripts (scripts/motion_pipeline.py, scripts/compile_scroll_video.py, scripts/media_edges.py). These commands are executed as a list of arguments without spawning a shell, which prevents common command injection vulnerabilities.\n- [DYNAMIC_EXECUTION]: In scripts/production_gate.py, the skill implements a custom YAML loader UniqueKeyLoader derived from yaml.SafeLoader. This implementation is used to securely process configuration files while preventing duplicate key injection, demonstrating adherence to secure coding practices despite the use of yaml.load.\n- [INDIRECT_PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection by ingesting and processing untrusted external data.\n
Ingestion points: User-provided media files (videos, images) and YAML configuration files (source/concept-contract.yaml) are processed at runtime by the skill's Python scripts.\n
Boundary markers: While the skill uses structured formats like YAML and JSON, it does not implement specific delimiters or explicit instructions to ignore potentially malicious embedded content within media metadata.\n
Capability inventory: The skill possesses capabilities to write to the file system, execute local subprocesses, and orchestrate complex media transformation pipelines.\n
Sanitization: The skill performs path resolution and expansion but lacks specific sanitization for metadata or embedded comments within the media files it processes.

oil-motion