The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides several automation recipes (e.g., in automation/beat-sync.md and automation/batch-pipeline.md) that utilize subprocess.run(cmd, shell=True) in Python or direct string interpolation in Bash loops. These patterns incorporate file paths (such as $INPUT or video_path) directly into shell commands without sanitization. This presents a risk of command injection if the agent or user processes files with filenames containing shell metacharacters (e.g., ;, &, or |).
[EXTERNAL_DOWNLOADS]: The skill instructs the installation of several external dependencies across its documentation, including openai-whisper, faster-whisper, librosa, aubio, numpy, moviepy, and scenedetect. These are well-known, industry-standard packages for audio and video processing and are considered safe within the context of the skill's primary function.
[DATA_EXFILTRATION]: The skill includes recipes for interacting with the ElevenLabs API for audio isolation and transcription. It correctly suggests using environment variables ($ELEVENLABS_API_KEY) for secret management rather than hardcoding credentials, which is a safe practice. The data transmission to ElevenLabs is consistent with the skill's stated purpose of AI-assisted video editing.

ultimate-video-editor