The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides templates for shell curl commands to be executed by the agent. These commands incorporate user-supplied variables for file paths, narration scripts, and API keys. This pattern creates a command injection surface if the agent does not properly escape or sanitize user-controlled strings before passing them to the shell.
[DYNAMIC_EXECUTION]: The agent is instructed to dynamically assemble JSON payloads and shell command strings at runtime. This process involves concatenating user-provided inputs—such as video_prompt, voice_script, and audio URLs—into executable command arguments and request bodies.
[INDIRECT_PROMPT_INJECTION]: The skill maintains an attack surface for indirect injection by processing external and user-provided data.
Ingestion points: User-provided voice_script, portrait image URLs, and narration audio URLs found in SKILL.md.
Boundary markers: None identified; inputs are interpolated directly into shell commands and JSON payloads without delimiters or warnings.
Capability inventory: Execution of network operations and shell commands via curl to api.pruna.ai (SKILL.md).
Sanitization: There are no instructions for sanitizing, validating, or escaping user inputs before they are included in the generated commands.
[EXTERNAL_DOWNLOADS]: The skill facilitates the installation of additional components by fetching them from the vendor's official GitHub repository (PrunaAI/pruna-skills) using the npx skills add utility.

p-video-avatar