The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes a local Node.js script (scripts/breakdown.js) that executes external binaries (ffmpeg and ffprobe) to analyze video files. The script uses execFileSync and spawnSync with argument arrays, which is a secure method for executing subprocesses that prevents common shell injection vulnerabilities. Inputs such as the scene detection threshold are explicitly converted to numbers before being passed to the command line.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze external data from video files and descriptions fetched via yt-dlp. While this represents an attack surface for indirect prompt injection (e.g., malicious metadata in a video description influencing the agent's interpretation), the risk is considered low as the processing is technical and analytical, and the script handles metadata strictly for reporting purposes.
[EXTERNAL_DOWNLOADS]: The documentation suggests the use of yt-dlp to download video references. yt-dlp is a well-known and legitimate utility for media analysis. The skill correctly advises users to keep these external assets outside of the project repository to prevent accidental data leakage.
[DYNAMIC_EXECUTION]: The breakdown.js script generates file paths and execution parameters at runtime based on the video analysis results. These operations follow standard programming practices for media processing tools and do not involve the execution of untrusted code or unsafe deserialization.

ae-reference-breakdown