The Agent Skills Directory

[COMMAND_EXECUTION]: The skill extensively uses ffmpeg and ffprobe for video extraction, analysis, rendering, and quality control. These commands are executed via the Python subprocess module using list-style arguments, which avoids shell invocation and mitigates command injection vulnerabilities.
[EXTERNAL_DOWNLOADS]: The skill workflow depends on external scripts and sibling skills, including video-use/helpers/transcribe.py and the ra-audio-to-subtitles skill. These are documented as vendor-specific dependencies necessary for the integrated workflow.
[PROMPT_INJECTION]: The skill processes ASR-generated transcripts which could potentially contain malicious instructions (indirect prompt injection). This risk is effectively mitigated by a mandatory human-in-the-loop approval step described in the workflow, where the agent is instructed to stop and wait for explicit user confirmation of the corrected text before proceeding to any destructive or rendering actions.
[SAFE]: Analysis of the Python scripts confirms that data processing is restricted to local job directories, and no network exfiltration or credential harvesting patterns were identified. Third-party dependencies such as numpy and Pillow are standard for the described media processing tasks.

ra-local-talking-head-cut