The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses the node:child_process execFile method in media.mjs to execute ffmpeg and ffprobe for media analysis and video assembly. It passes arguments directly to the executable as an array, which mitigates common shell injection risks associated with exec.
[EXTERNAL_DOWNLOADS]: The skill makes network requests to openrouter.ai for text, image, video, and speech generation services, and to r2.cloudflarestorage.com (Cloudflare R2) for media storage. These are well-known technology service providers.
[DATA_EXFILTRATION]: The r2.mjs module provides functionality to read local files and upload them to a configured Cloudflare R2 bucket. This is a primary intended feature of the skill, used to host media assets for retrieval by AI providers.
[DYNAMIC_EXECUTION]: The drafts.mjs module uses dynamic import() to lazily load the text model module. The path for this import is determined by environment variables (STUDIO_CORE_TEXT_ENTRY) or relative file structure, allowing flexible module resolution in development and production environments.
[INDIRECT_PROMPT_INJECTION]: The extractJson and generateJson functions in drafts.mjs process output directly from Large Language Models. The skill uses regex extraction and a custom schema validator (validate.mjs) to verify the data structure, which reduces but does not eliminate the risk of the agent acting on malicious instructions embedded in untrusted LLM responses.

studio-core