The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests external data through the import-srt command (SRT subtitle files) and processes project metadata from files like draft_content.json. These files represent ingestion points where external data enters the agent's context. While the skill treats these inputs as technical metadata for video editing, the processing of untrusted external content constitutes an attack surface for indirect injection.
[DYNAMIC_EXECUTION]: Helper scripts such as anim.sh, long-to-short.sh, and _test.sh utilize node -e to execute inline JavaScript logic. This method is used to perform complex JSON transformations and project calculations that are difficult in pure shell script. Arguments are passed to the Node process via standard argument arrays to mitigate injection risks, but the pattern of dynamic logic execution is noted.
[EXTERNAL_DOWNLOADS]: The add-video and add-audio commands support fetching media assets directly from Wikimedia Commons and Wikipedia. The skill implements domain-level checks to ensure network requests are restricted to these trusted and well-known services. It also includes license classification logic to identify and warn the user about restrictive usage terms for the downloaded content.
[COMMAND_EXECUTION]: The skill operates by executing a local CLI tool and several wrapper shell scripts. These scripts perform various system-level tasks including reading and writing to project directories, generating UUIDs, and calling other utilities like node and jq to manage the video project lifecycle.

capcut-edit