The Agent Skills Directory

[COMMAND_EXECUTION]: The skill makes extensive use of ffmpeg and ffprobe to analyze, extract, reframe, and encode video content. These tools are invoked both through direct shell instructions provided to the agent and via a Python manifest generation script.
Evidence: Found in SKILL.md, references/01-source-intake.md, references/02-analysis.md, references/03-clip-production.md, and scripts/generate-clip-manifest.py.
Security Note: The generate-clip-manifest.py script correctly uses list-based arguments with subprocess.run(), preventing common shell injection vulnerabilities.
[EXTERNAL_DOWNLOADS]: The workflow supports downloading source video content from user-provided URLs using curl or ffmpeg to a local temporary directory.
Evidence: references/01-source-intake.md contains instructions to download source URLs for processing.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data (video and audio files) which could theoretically contain media-based instructions. This represents an attack surface typical of media processing tools.
Ingestion points: references/01-source-intake.md (source video URL/file).
Boundary markers: None explicitly for binary media content.
Capability inventory: Extensive file writing (clips, manifests, logs) and subprocess execution (ffmpeg, ffprobe, whisper) across all reference files.
Sanitization: The Python script uses safe subprocess calls; however, the markdown instructions rely on the agent to safely interpolate variables into shell command strings.

paw-cra-video-clips