The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses subprocess.run and subprocess.Popen extensively to execute media processing tools (ffmpeg, ffprobe) and sibling Python scripts (e.g., generate_speech.py, generate_video.py). This is standard functionality for an orchestrator tool and is used to process video and audio assets using the list-based command format which mitigates shell injection risks.
[CREDENTIALS_UNSAFE]: The skill includes a mechanism to resolve a Replicate API token by checking environment variables, local configuration files, and configuration files of sibling skills. While this searches multiple locations, it is restricted to the replicate_api_token field and is a design choice to allow shared credentials across a suite of related media tools.
[DYNAMIC_EXECUTION]: The skill performs dynamic module loading in _arc_common.py to import sibling modules (_video_pipeline and _common from the video-compose skill) and uses __import__ in finish_reel.py for regular expression initialization. These are used for project organization and standard text processing and do not involve executing untrusted or remote code strings.
[INDIRECT_PROMPT_INJECTION]: The skill ingests script text and scene descriptions from a user-provided storyboard to generate prompts for remote AI models (TTS and video generation). While this represents an attack surface for the remote models, the skill behaves as a transparent conduit for the user's creative input and focuses on media orchestration rather than autonomous decision-making.

avatar-reel-composer