The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied prompts and remote media content which are then transmitted to external AIGC APIs and processed by local media tools.
Ingestion points: The skill accepts user prompts via the --prompt argument and handles external media URLs or local file paths via --image, --last-frame, --ref-image, --ref-video, and --ref-audio in the provider-specific scripts (gen_dashscope.py, gen_minimax.py, and gen_volc.py).
Boundary markers: The skill does not implement specific boundary markers or delimiters to separate instructions from user-provided data within the generated prompts sent to AIGC providers.
Capability inventory: The skill utilizes subprocess.run for media processing via ffmpeg and ffprobe in scripts/aigc_common.py, performs network requests via urllib.request to interact with AIGC APIs and download generated content, and writes media and metadata files to the local filesystem.
Sanitization: File output paths are strictly validated using the ensure_safe_output function in scripts/aigc_common.py, which prevents directory traversal and restricts writes to a set of predefined safe directories.
[COMMAND_EXECUTION]: The skill uses subprocess.run to execute ffmpeg and ffprobe for media metadata extraction and frame capturing in scripts/aigc_common.py. These commands are executed using list-based arguments which mitigates shell injection risks.
[EXTERNAL_DOWNLOADS]: The skill downloads generated media files from remote provider URLs (DashScope, Volcengine, and MiniMax) using urllib.request in scripts/aigc_common.py. These are legitimate operations targeting well-known service providers.

aigc-video-gen