The Agent Skills Directory

[SAFE]: The skill incorporates multiple security best practices. The Artifacts class in lib/artifacts.js uses the assertWithinRoot utility to strictly enforce that all file operations are confined to the designated .artifacts directory, successfully mitigating path traversal risks. The ZynnaOpenSkillsClient in lib/zynna-client.js includes robust redaction logic to ensure that API keys and authorization headers are removed from error messages and logs before output. Additionally, the configuration logic in lib/config.js implements transport security by refusing insecure HTTP connections to non-local hosts unless specifically overridden by an environment variable. While the skill accesses ~/.zynna/credentials.json for authentication, this is a legitimate use of vendor-specific configuration files. The skill also manages untrusted data from the Zynna API by treating it as structured artifacts and avoiding high-risk operations like dynamic execution or shell interpolation with the received content.

zynna-generate-video