The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes subprocess.run to execute FFmpeg for video processing. While it follows best practices by using argument lists rather than shell strings, it dynamically constructs an FFmpeg filter string (subtitle_filter) using f-string interpolation of a filename. If filenames were to contain certain special characters, it could potentially cause the filter to fail or behave unexpectedly.
[PRIVILEGE_ESCALATION]: Setup instructions include a sudo apt install ffmpeg command. While FFmpeg is a standard dependency for video manipulation, the requirement for root access during environment setup is a privilege escalation finding that should be noted.
[INDIRECT_PROMPT_INJECTION]:
Ingestion points: The topic parameter in the generate_script and generate_video functions (found in SKILL.md) accepts arbitrary user input.
Boundary markers: None. The user-provided topic is directly interpolated into a f-string prompt passed to the Anthropic API.
Capability inventory: The skill possesses the capability to perform network operations (requests), file system writes (open), and system command execution (subprocess.run).
Sanitization: There is no evidence of input validation, sanitization, or escaping of the topic variable before it is used to generate the video script, making it susceptible to prompt injection attacks where a user could override the intended script format or content.

ai-video-generator