The Agent Skills Directory

[COMMAND_EXECUTION]: The toolkit consists of several Python, Node.js, and shell scripts that invoke external binaries including ffmpeg, ffprobe, curl, and node to process media files and interact with APIs. These operations are central to the skill's primary purpose and include measures to prevent command injection, such as passing arguments as lists and using standard inputs for credentials.
[DYNAMIC_EXECUTION]: The rendering engine (render.mjs) dynamically loads the puppeteer-core library from a user-supplied dependency root. Additionally, the image preparation script (prep_images.py) compiles a Swift helper tool (cutout.swift) at runtime on macOS for background removal tasks.
[EXTERNAL_DOWNLOADS]: The skill fetches audio and image assets from ElevenLabs and Codex APIs. These network operations are strictly opt-in, requiring the user to provide their own API keys in the environment, and are triggered by specific user commands within the production workflow.
[INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied video scripts (script.json) and project configurations. While this provides an attack surface for influencing local command execution, the skill implements strong mitigations including no_links functions to block symlink-based path traversal and a local loopback server for rendering that uses a strict Content Security Policy (CSP) and an allowlist of accessible files.

omh-show-reel