The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/transcribe_video.py interacts with ffmpeg and ffprobe to process media files. It utilizes subprocess.run with list-based arguments and avoids the use of shell=True, which effectively prevents shell injection vulnerabilities.
[DATA_EXPOSURE]: The tool requires an OPENAI_API_KEY for cloud transcription, which it correctly retrieves from the environment. It reads local media files and writes markdown transcripts to a designated directory, aligning with its documented purpose. The hardcoded paths in the documentation are consistent with the author's environment.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted media content to generate text. It mitigates potential risks by using regex-based filename sanitization (sanitize_stem) and by treating the output as static markdown content rather than executable instructions. There is no evidence of a data-to-code flow that would allow the transcript to influence the agent's logic.
[EXTERNAL_DOWNLOADS]: The skill depends on well-known, standard libraries openai and openai-whisper from the official Python Package Index (PyPI).

speech-video-transcriber