The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses the subprocess module to interact with system-level media utilities for video composition, metadata extraction, and HTML rendering.
Evidence: Multiple files including cmm/compose.py, cmm/html_assets.py, and cmm/transcription.py invoke ffmpeg, ffprobe, and node.
Security: All calls are implemented using list-based arguments (e.g., subprocess.run([...])), which prevents shell command injection. Input paths are resolved and validated before use.
[DYNAMIC_EXECUTION]: The installation and verification script includes a self-test mechanism that executes a small portion of the skill's own code.
Evidence: install.sh uses exec(compile(...)) to extract and validate an example screenplay dictionary from the mm CLI script.
Security: This is a restricted diagnostic check that only processes a fixed string from the local skill file; it does not accept or execute arbitrary user-supplied code.
[SAFE]: The skill includes several proactive security measures to ensure safe operation within the agent environment.
Rendering Isolation: cmm/capture.mjs configures the headless browser with --host-resolver-rules='MAP * ~NOTFOUND' for local rendering, preventing unintended outbound network calls during card generation.
Protocol Enforcement: cmm/html_assets.py enforces a strict check to ensure URL-based screenshots are limited to http and https protocols, mitigating local file exposure via the URL field.
Integrity Verification: cmm/run_contract.py implements a fingerprinting system that hashes all source assets and HTML content to ensure that the rendered video matches the reviewed screenplay.

magic-moment