The Agent Skills Directory

[COMMAND_EXECUTION]: The skill's core functionality relies on executing ffmpeg and ffprobe via the subprocess module. These calls are essential for the primary purpose of video color grading and rendering. Evidence of this pattern is found across several files: scripts/media.py (probing and encoding), scripts/match.py (cropping reference images), scripts/render_looks.py (applying LUTs), and scripts/showreel.py (assembling the final reel).
[INDIRECT_PROMPT_INJECTION]: The skill exposes an indirect prompt injection surface by ingesting untrusted data and interpolating it into shell commands. 1. Ingestion points: Untrusted data enters the context through looks.json configuration files (e.g., in scripts/render_looks.py) and command-line arguments like --crop (in scripts/match.py). 2. Boundary markers: There are no specific delimiters or safety instructions used to separate the interpolated data from the ffmpeg filter graph syntax. 3. Capability inventory: The skill has the capability to run arbitrary ffmpeg filter chains via subprocess.run and subprocess.Popen in scripts/render_looks.py and scripts/media.py. 4. Sanitization: While arguments are passed to the subprocess module as lists (preventing direct shell injection), the internal syntax of ffmpeg filter strings remains susceptible to manipulation if parameters contain filter-chain delimiters like commas or semicolons.

scenario-video-color-grade