The Agent Skills Directory

[COMMAND_EXECUTION]: The primary script references/ofox-video.sh executes several command-line utilities including curl for network communication with the Ofox API, jq for JSON processing, and ffmpeg/ffprobe for local video operations like frame extraction, concatenation, and audio muxing. These executions are functional and tied directly to the skill's intended purpose.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted user data in the form of video prompts, which are then interpolated into JSON payloads and transmitted to a remote video generation model. While this creates a vulnerability surface, the skill includes sanitization logic (e.g., in build_output_slug) to ensure that prompts cannot be used for path traversal or malicious filename construction. The script's logic is primarily an execution wrapper and does not interpret the prompt content directly.
[DYNAMIC_EXECUTION]: Several test files (e.g., references/test/concurrency.test.sh, references/test/handoff.test.sh) dynamically create and execute temporary shell scripts and modified versions of the main execution script to simulate API responses and mock functions for unit testing. This behavior is confined to the test environment and is not used during standard skill operation.

ofox-video-core