The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the user to clone a repository from https://github.com/digitalsamba/claude-code-video-toolkit.git. This source is not associated with the skill author ('reason-machines') and is not recognized as a trusted organization, posing a supply chain risk.
[COMMAND_EXECUTION]: The toolkit performs multiple shell operations including cloning remote code, installing external dependencies via pip and npm, and deploying infrastructure to cloud GPU providers using modal deploy.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted external data from script.md and project.json which are used to generate AI assets (voiceover, images, video).
Ingestion points: script.md (voiceover script), project.json (scene intents and asset descriptions).
Boundary markers: None identified; the instructions do not include delimiters or warnings to ignore instructions embedded within the user-provided scripts.
Capability inventory: The skill has capabilities for file writes (rendering video), network operations (API calls to ElevenLabs, Modal, RunPod, and Cloudflare R2), and executing local scripts.
Sanitization: There is no evidence of sanitization or validation performed on the input scripts before they are passed to external AI services or local generation tools.

claude-code-video-toolkit