The Agent Skills Directory

[COMMAND_EXECUTION]: The skill includes a script _postplus_shared/00-core/shared-runtime/scripts/download_videos_from_manifest_with_ytdlp.mjs that executes python3 -m yt_dlp via child_process.spawn. This is used to download media files for quality inspection and follows secure execution patterns.
[EXTERNAL_DOWNLOADS]: Media assets are downloaded from external source URLs provided in manifest files. This behavior is documented and necessary for the skill's primary purpose of reviewing generated content.
[PROMPT_INJECTION]: The skill has an indirect prompt injection surface as it processes human-provided feedback and manifest data.
Ingestion points: Human review notes and manifest URL fields.
Boundary markers: None present.
Capability inventory: Local command execution (yt-dlp), network requests via vendor APIs, and local file management.
Sanitization: Basic validation and type checking are implemented in scripts/build_creative_qa_record.mjs.
[SAFE]: The skill adheres to the expected behavior for a media production tool. It manages authentication through local configuration files and uses standard system utilities without demonstrating malicious intent or obfuscation.

creative-qa