The Agent Skills Directory

[COMMAND_EXECUTION]: The video-to-spritesheet.mjs script executes shell commands using execSync to invoke ffmpeg and ffprobe. The script constructs these commands by interpolating variables—such as file paths and frame dimensions—directly into the command string. Since these variables are not sanitized or escaped, a malicious actor could use shell metacharacters like backticks or command substitution syntax ($(...)) to execute arbitrary unauthorized commands on the host system.
[INDIRECT_PROMPT_INJECTION]: The skill exhibits a vulnerability to indirect prompt injection due to its handling of external data.
Ingestion points: User-provided image paths and animation descriptions are passed directly from $ARGUMENTS to the generation and conversion scripts (Step 0 and Step 3 in SKILL.md).
Boundary markers: The instructions do not define delimiters or specific constraints to prevent the agent from interpreting embedded commands within these inputs.
Capability inventory: The skill has the ability to execute shell commands (execSync), perform network requests (fetch), and write files to the local disk (writeFile).
Sanitization: There is no evidence of input validation or shell escaping performed on the arguments before they are used in sensitive execution contexts.
[EXTERNAL_DOWNLOADS]: The skill fetches video files from api.klingai.com and other result URLs generated by the Higgsfield backend. These network operations are integral to the skill's primary function and target established service domains associated with the AI video generation tools.

animate-character