The Agent Skills Directory

[COMMAND_EXECUTION]: The orchestration scripts scripts/render-video.sh and scripts/render-headless.sh use eval and bash -c to execute shell commands constructed through string concatenation. This pattern is vulnerable to command injection if variables like $title, $logo, or $repo_path contain malicious shell metacharacters.
[COMMAND_EXECUTION]: The script scripts/install-gource.sh utilizes sudo apt-get to install system-level dependencies. While common for installers, this grants the skill elevated privileges during the setup phase.
[EXTERNAL_DOWNLOADS]: The skill fetches contributor profile pictures from GitHub's official API (api.github.com) and avatar services in scripts/resolve-avatars.sh.
[EXTERNAL_DOWNLOADS]: Installation procedures described in references/installation-guide.md and scripts/install-gource.sh involve downloading packages from official system registries (APT, Homebrew).
[PROMPT_INJECTION]: The skill ingests untrusted data from repository history (git logs, tags, and contributor emails) and processes it to generate visualizations and fetch external avatars. This data is passed to subprocesses including Gource, FFmpeg, and ImageMagick (convert), creating a surface for potential indirect injection attacks through malicious repository metadata.
Ingestion points: scripts/resolve-avatars.sh (GitHub API), scripts/detect-repo.sh (git log), scripts/generate-captions.sh (git tags).
Boundary markers: Absent.
Capability inventory: Subprocess execution of Gource, FFmpeg, ImageMagick across all render scripts; shell orchestration in scripts/render-video.sh.
Sanitization: json_escape in scripts/detect-repo.sh provides minimal sanitization for JSON output; however, shell interpolation in scripts/render-video.sh lacks robust escaping.

gource-visualizer