The Agent Skills Directory

[COMMAND_EXECUTION]: The skill relies on subprocess.run to execute ffmpeg and ffprobe commands for video processing and metadata extraction. While it uses list-based arguments rather than a shell string, the inclusion of external file paths in these commands can lead to argument injection vulnerabilities if the paths are not strictly validated.
[REMOTE_CODE_EXECUTION]: In the probe_video function in SKILL.md, the code uses eval(video_stream["r_frame_rate"]) to parse a string into a numeric value. Since this string is derived from the metadata of a video file provided as input, it constitutes an unsafe dynamic execution vulnerability. A maliciously crafted video file could provide a Python expression in the frame rate field that would be executed by the host environment when the skill probes the video properties.

video-frames