The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes several bundled Python scripts and standard media utilities (ffmpeg, ffprobe) to process video segments. These commands are executed using safe subprocess calls with arguments passed as lists, which prevents shell injection.
[EXTERNAL_DOWNLOADS]: The skill downloads video assets from the RunningHub platform as part of its primary function. It also provides a manual download link for a local adapter client hosted on a common file-sharing service (pan.quark.cn), which is documented as a required manual step for the user rather than an automated execution.
[PROMPT_INJECTION]: The workflow involves processing untrusted user data such as lyrics, style descriptions, and visual references which are passed through the pipeline to other agents. While this creates an ingestion surface for indirect prompt injection, the skill maintains clear boundaries by snapshotting all stage handoffs. Evidence chain:
Ingestion points: User-provided lyrics, project titles, style descriptions, and character/scene references are ingested as documented in SKILL.md and references/contracts.md.
Boundary markers: The skill uses an 'Immutable stage handoff' system documented in references/contracts.md to isolate data between stages via snapshots.
Capability inventory: Subprocess calls to ffmpeg and ffprobe are present in scripts/download_validate_assemble.py and scripts/validate_production_manifest.py. Network operations via httpx are present in scripts/h3gen_queue.py.
Sanitization: The scripts/build_manual_upload_package.py script implements safe_component to sanitize string identifiers used in file paths and resolve_inside to prevent path traversal.

mvmaker-h3-skill