The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests user-provided creative briefs and media metadata which are subsequently interpolated into LLM prompts for drafting video treatments and Edit Decision Lists (EDLs).
Ingestion points: The --brief argument in scripts/treatment.py and the description fields in media assets processed by scripts/generate_edl.py.
Boundary markers: The skill does not use explicit delimiters or specific instructions to isolate user-provided data from system instructions in its LLM prompts.
Capability inventory: The skill has the ability to execute shell commands via FFmpeg and Remotion, write to the local filesystem, and communicate with external AI APIs (Google Gemini, Groq, and Replicate).
Sanitization: There is minimal sanitization of user-provided strings before they are incorporated into prompts, though preview.py sanitizes labels for FFmpeg filters.
[COMMAND_EXECUTION]: The skill relies heavily on the subprocess module to run FFmpeg, ffprobe, and the Remotion CLI for rendering titles and compositing the final video.
Evidence: scripts/_common.py, scripts/_video_pipeline.py, scripts/preview.py, and scripts/render_titles.py use subprocess.run to call external binaries. Command arguments are passed as lists to prevent shell injection vulnerabilities.
[CREDENTIALS_UNSAFE]: The skill includes functionality to automatically discover and import API tokens (for Replicate and Gemini) from the configuration files of sibling skills.
Evidence: scripts/setup_key.py and scripts/_common.py scan for config.json files in the directories of other vendor-related skills (e.g., bg-music-hq, avatar-video-reel) to facilitate shared credential management.
[EXTERNAL_DOWNLOADS]: The skill installs necessary dependencies from official and well-known registries.
Evidence: SKILL.md provides instructions for installing Python packages from PyPI via requirements.txt and Node.js packages from the NPM registry for the Remotion title engine.

video-compose