The Agent Skills Directory

[COMMAND_EXECUTION]: The skill performs service management using docker compose and curl. Privileged operations, such as changing host directory ownership, use sudo -n to ensure non-interactive execution, which is a defensive best practice for agent-driven environments.
[EXTERNAL_DOWNLOADS]: The deployment process pulls container images from NVIDIA's registry (nvcr.io) and downloads model weights from Hugging Face (huggingface.co). Both are well-known and trusted sources for these assets.
[PROMPT_INJECTION]: The skill documents an interface for a service that processes untrusted text and video data, which represents a surface for indirect prompt injection.
Ingestion points: REST API endpoints POST /v1/generate_text_embeddings, POST /v1/generate_video_embeddings, and POST /v1/files in references/rest-api.md.
Boundary markers: Absent. The skill does not explicitly instruct the agent to use delimiters or 'ignore embedded instructions' warnings when sending data to these endpoints.
Capability inventory: The skill uses curl to interact with the service API and docker compose to manage the service lifecycle.
Sanitization: Absent in the skill instructions, although the service API itself performs schema validation and returns 422 errors for malformed requests.
[SAFE]: The skill demonstrates secure credential handling by documenting sensitive environment variables (NGC_API_KEY, HF_TOKEN, REDIS_PASSWORD) and instructing users to manage them via environment variables or secret managers rather than hardcoding them.
[SAFE]: The documentation in references/rest-api.md includes a specific security warning regarding the file:// URI scheme, explaining the risk of arbitrary local file access and providing mitigation guidance via the FILE_URL_ALLOWED_DIRS configuration.

vss-deploy-video-embedding