The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses ffmpeg and ffprobe for legitimate media processing tasks, such as extracting frames from generated videos and performing quality checks (continuity, frozen frames, audio presence). All command construction in frames.sh and generate.sh uses proper variable quoting to prevent shell injection.
[EXTERNAL_DOWNLOADS]: The skill communicates with official, well-known AI provider endpoints (Google Gemini, OpenAI, and RunwayML). These are standard service integrations. The installer install-everywhere.sh downloads the skill from the vendor's own repository (github.com/olegspiridonovdev-spec/cinematic-video-skill.git), which is consistent with the author's identity.
[CREDENTIALS_UNSAFE]: The skill correctly instructs users to manage API keys via environment variables (GEMINI_API_KEY, OPENAI_API_KEY, RUNWAY_API_KEY). It does not hardcode any secrets or suggest insecure storage methods.
[DATA_EXFILTRATION]: No evidence of data exfiltration was found. Network operations are limited to sending prompts to the specified AI providers and downloading the resulting video files to a local directory (~/Downloads).
[PROMPT_INJECTION]: The skill contains no adversarial instructions or bypass attempts. It provides a structured '12-block shot contract' designed to improve the quality of AI-generated video through detailed cinematography terminology.
[DYNAMIC_CONTEXT_INJECTION]: The skill uses dynamic context markers () in its installation script to manage instruction blocks in configuration files, but these are used for text templating rather than executing arbitrary shell commands at load time.

cinematic-video