The Agent Skills Directory

[SAFE]: The skill implements a library of functions to interact with the api.ofox.ai service. All network operations are directed towards this vendor-owned API or related content delivery networks (CDNs) for downloading generated video results.
[CREDENTIALS_SAFE]: The skill documentation and the ofox-video.sh script enforce strict safety rules for the OFOX_API_KEY, reading it only from the environment and explicitly avoiding logging or printing it in any output. The script is designed to fail gracefully if the key is missing without leaking sensitive environment information.
[INDIRECT_PROMPT_INJECTION]: The skill ingests user-supplied prompts and external image/video URLs as reference data for video generation. While this constitutes an attack surface, the risk is mitigated by using jq for the safe construction of JSON request bodies, which prevents prompt injection into the API protocol layer. Furthermore, the skill sanitizes prompt-derived text using the build_output_slug function when generating local filenames, effectively preventing directory traversal attacks.

ofox-video-core