The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes ffmpeg via Node.js child_process.execFile for media probing and subtitle burn-in. Arguments are constructed using sanitized inputs and platform-specific path resolution to prevent shell injection.
[EXTERNAL_DOWNLOADS]: Downloads media assets and project configuration files from the vendor's official domains (perso.ai, portal-media.perso.ai) and GitHub repositories as part of its subtitle extraction and styling workflows.
[DATA_EXFILTRATION]: Sends usage telemetry and media processing requests to the vendor's API. The skill includes explicit instructions and code safeguards to ensure that the XP-API-KEY is handled securely and never passed as a command-line argument or revealed in chat logs.
[PROMPT_INJECTION]: Indirect prompt injection surface exists as the skill processes untrusted text content from subtitle files (SRT) for translation.
Ingestion points: Reads SRT content from local files or URLs during the translation phase described in SKILL.md.
Boundary markers: The instructions explicitly define the scope of translation ("Translate only the text lines") and mandate the preservation of SRT structural elements.
Capability inventory: Subprocess execution for ffmpeg, local file system writes for SRT/MP4, and network operations to the vendor API.
Sanitization: The lib/subtitle_style.mjs script includes the assText function which sanitizes input strings by stripping backslashes and braces to prevent Advanced Substation Alpha (ASS) override injection during the hardsubbing process.

srt