The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from the workspace to generate video content, creating an attack surface for indirect prompt injection.
Ingestion points: The instructions in SKILL.md direct the agent to read ../ketchup/SKILL.md and workspace artifacts including screenshots, recordings, diffs, and data produced by recent work.
Boundary markers: There are no explicit delimiters or instructions provided to the agent to ignore potentially malicious instructions embedded within the ingested data.
Capability inventory: The skill requires writing files (rendering video) to a temporary directory outside the repository and likely involves subprocess calls to video processing tools.
Sanitization: No sanitization, escaping, or validation steps are defined for the text labels or subtitles derived from the external workspace data.
[COMMAND_EXECUTION]: The requirement to "Render one silent landscape video, such as an mp4" (in SKILL.md) implies the use of external video processing tools. This typically involves executing subprocesses which could be targeted if the input data (labels/subtitles) is not handled safely by the rendering tool.
[SAFE]: The THIRD_PARTY_NOTICES.md file correctly attributes source material to a repository from Cursor (github.com/cursor/plugins), which is a well-known service in the development ecosystem.

ketchup-video