The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes local media utilities to perform video processing tasks.
Evidence: In scripts/_common.py, the run function wraps subprocess.run. It correctly passes command arguments as a list and does not use shell=True, which is a secure way to execute external binaries like ffmpeg and ffprobe without risk of shell command injection.
[EXTERNAL_DOWNLOADS]: The skill requires a well-known image processing dependency.
Evidence: The scripts/requirements.txt file specifies Pillow>=10.0, which is a standard and trusted library in the Python ecosystem for image manipulation.
[INDIRECT_PROMPT_INJECTION]: The skill provides an attack surface through the ingestion of external media files, though no direct prompt interpolation was found.
Ingestion points: The overlay_pip function in scripts/pip_overlay.py accepts external file paths for base and avatar video clips.
Boundary markers: Not applicable, as the skill performs media transformation rather than LLM prompt generation.
Capability inventory: The skill can execute shell commands via subprocess.run (for ffmpeg/ffprobe) and perform file system writes (for manifest.json updates).
Sanitization: The skill utilizes pathlib.Path for safe path handling and employs list-based argument passing for all subprocess calls to mitigate command injection and path traversal risks.

broll-core