The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses a Python script (extract_frames.py) to execute standard system binaries (ffmpeg, ffprobe, tesseract) for video processing and OCR.
Evidence: The script builds command arguments as lists and calls subprocess.run without enabling the shell (shell=True), which prevents shell injection vulnerabilities.
Context: Binaries are located via shutil.which and the script provides clear error messages if dependencies are missing.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data, including local video files and transcript files, which are summarized into a timeline.json digest for the agent to read.
Ingestion points: Video frames processed by tesseract for OCR and local transcript.json files for speech alignment.
Capability inventory: Subprocess execution of video processing tools and local file writing for frames and metadata.
Sanitization: The results are properly encoded as JSON using json.dumps. The skill includes instructions for the agent to treat OCR output as a search index rather than a source of truth due to potential mangling.
Boundary markers: The workflow dictates reading the structured timeline.json summary before opening individual images, reducing the risk of accidental execution of embedded instructions.

video-keyframes