The Agent Skills Directory

[COMMAND_EXECUTION]: The skill relies on system utilities ffmpeg and ffprobe to sample video frames and analyze motion. These tools are invoked via Python's subprocess.run using list-formatted arguments, which prevents shell injection by ensuring filenames and parameters are not interpreted as shell commands.
[EXTERNAL_DOWNLOADS]: The seams.py script attempts to dynamically install the 'pillow' package from the official Python Package Index (PyPI) if it is missing at runtime. This is a common library for image manipulation, and while dynamic installation is a dependency risk, it targets a well-known package from a trusted registry.
[PROMPT_INJECTION]: The skill processes untrusted video files provided by users. This presents an indirect prompt injection surface where visual instructions or text embedded within video frames could attempt to influence the agent's interpretation or subsequent actions. This is documented as a risk factor inherent to the skill's primary purpose.
Ingestion points: SKILL.md and scripts/contact_sheet.py process external video files for frame extraction.
Boundary markers: Absent; the agent is instructed to read and interpret the output images directly.
Capability inventory: File system read/write, and execution of media processing binaries via subprocess.run.
Sanitization: Input paths are treated as strings and passed directly to subprocess calls without shell evaluation.

parsing-video