The Agent Skills Directory

[COMMAND_EXECUTION]: The script render-video.py invokes external tools including ffmpeg, ffprobe, and swiftc. These calls use the subprocess.run method with a list of arguments, which correctly prevents shell injection vulnerabilities even when handling user-provided file paths.
[DYNAMIC_EXECUTION]: The skill performs runtime compilation of a Swift source file (render-masks.swift) using the system compiler (swiftc). This is done to provide a high-performance mask renderer using native macOS CoreText APIs. The compilation process is local, transparent, and essential to the primary function of the skill.
[INDIRECT_PROMPT_INJECTION]: The skill ingests user-provided timing data from cards.json. The data is parsed as structured JSON and used as parameters for the video rendering engine. There is no evidence that this data can influence the control flow of the agent or the underlying shell commands, as inputs are strictly validated and handled as non-executable strings.

inverted-lyrics