The Agent Skills Directory

[COMMAND_EXECUTION]: The skill makes extensive use of subprocess.run to execute system-level utilities for media processing, including ffmpeg, ffprobe, tesseract, magick (ImageMagick), and sips (macOS Image Processing).
[DYNAMIC_EXECUTION]: On macOS systems, the skill performs runtime compilation of its own source code. In scripts/parse_media.py, it uses swiftc to compile ocr_macos.swift into a binary executable inside a .runtime directory before execution.
[COMMAND_EXECUTION]: On Windows, the skill executes a PowerShell script (ocr_windows.ps1) using the -ExecutionPolicy Bypass flag to perform system-level OCR tasks.
[DATA_EXFILTRATION]: The skill is designed to transmit local media files and metadata to external multimodal API providers (ZenMux, Alibaba/Bailian, OpenRouter, and Tokendance). This includes sending base64-encoded image and video data over the network.
[EXTERNAL_DOWNLOADS]: The scripts/parse_media.py file contains logic to download media from arbitrary user-provided URLs using urllib.request.urlopen, with a size limit of 512MB per file.
[CREDENTIALS_UNSAFE]: The scripts/onboard.py utility collects API keys for various providers and stores them in plaintext within environment-style configuration files (config.env). While the script attempts to set restrictive filesystem permissions (chmod 600 or icacls), the secrets are stored without encryption.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a significant attack surface for indirect prompt injection. A malicious image or video provided via URL could contain text instructions designed to manipulate the multimodal model's output, which is then fed back to the main agent as a trusted source.
Ingestion points: resolve_media in scripts/parse_media.py (external URLs and local files) and the --task CLI parameter.
Boundary markers: Absent; the multimodal model's response is directly written to a Markdown file without explicit delimiters or warnings to the reading agent.
Capability inventory: File system write (Path.write_text), network operations (request.urlopen), and command execution (subprocess.run for FFmpeg/OCR).
Sanitization: The safe_error function masks API keys in logs, and slug sanitizes output filenames, but there is no validation of the content extracted from media.

see