The Agent Skills Directory

[COMMAND_EXECUTION]: Numerous scripts within the scripts/batch_templates/ directory utilize subprocess.run() with shell=True to execute FFmpeg and other system utilities. The commands are constructed using f-strings that incorporate variables such as <地名> and <URL>. This pattern is susceptible to command injection if the agent processes malicious strings provided as place names or material identifiers.
[COMMAND_EXECUTION]: The skill's cleanup logic in SKILL.md involves executing rm -rf on paths derived from the <地名> placeholder. Failure to sanitize this input could result in the accidental or malicious deletion of unrelated files or directories.
[EXTERNAL_DOWNLOADS]: The skill relies on yt-dlp to download high-resolution video content from YouTube. While expected for the skill's purpose, this involves interacting with external, user-supplied URLs and executing a complex third-party binary.
[DATA_EXFILTRATION]: The scripts/douyin_publish.py script automates the login and publishing process on the Douyin creator platform. It captures screenshots at various steps and saves them to the /tmp directory (e.g., /tmp/douyin_step1.png). These screenshots may contain sensitive session information or personal details and are stored in a world-readable location.
[PROMPT_INJECTION]: The skill ingests untrusted external data in the form of YouTube transcripts (/tmp/<地名>_ja.srt). There are no structural boundary markers or security-focused sanitization to prevent indirect prompt injection. If a transcript contains malicious instructions, the agent—which has significant capabilities including file system access and shell execution—could be manipulated into performing unintended actions.

shizuka-na-tabi