The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The script scripts/url-to-video.ts contains logic to automatically execute sudo apt-get install to install system tools like ffmpeg and aubio-tools on Linux-based systems without requiring manual user intervention beyond a flag.
[REMOTE_CODE_EXECUTION]: The skill performs automatic installations of unverifiable dependencies at runtime using package managers:
scripts/url-to-video.ts executes npm install -g playwright.
scripts/analyze-audiomap.py and scripts/generate-bgm.py use pip install to install multiple Python packages including librosa, transformers, and torch.
[DYNAMIC_EXECUTION]: scripts/regenerate-scene.ts implements a dynamic code modification loop. It invokes a sub-agent via claude -p to rewrite the src/MainVideo.tsx file based on LLM critique. Crucially, the sub-agent is granted broad tool permissions including Bash, Edit, and Read, and uses the --dangerously-skip-permissions flag.
[INDIRECT_PROMPT_INJECTION]: The skill ingests content from arbitrary user-provided URLs during the 'harvesting' phase. This untrusted data is then used as context for the sub-agent's code regeneration loop, creating a path for a malicious website to influence the generated code or the sub-agent's execution environment.
[COMMAND_EXECUTION]: Several scripts, including scripts/url-to-video.ts, scripts/analyze-audiomap.py, and scripts/generate-bgm.py, execute arbitrary shell commands via execFileSync and subprocess.run to manage the underlying media toolchain.
[EXTERNAL_DOWNLOADS]: The skill routinely downloads external resources:
yt-dlp is used to fetch video and audio content from YouTube and Vimeo.
The transformers library is instructed to download large model weights (approx. 1.5GB) from Hugging Face during the first run of the BGM generator.

30x-web-to-video