The Agent Skills Directory

[COMMAND_EXECUTION]: Several scripts (scripts/clipcheck.py, scripts/qa.py, scripts/tts.mjs, and scripts/mix-bgm.sh) execute system commands using ffmpeg, ffprobe, and say. These operations are essential for video processing, audio normalization, and speech synthesis within the defined project workflow.
[EXTERNAL_DOWNLOADS]: The skill downloads external media from platforms like YouTube and Weibo via yt-dlp and fetches hot list data from Chinese social and news platforms (Baidu, Toutiao, Zhihu, etc.) for content ideation. It also makes legitimate API calls to Volcengine (ByteDance) for speech synthesis.
[INDIRECT_PROMPT_INJECTION]: The skill possesses an indirect injection surface as it is designed to ingest and process untrusted data from external news hot lists to generate video topic candidates. Malicious instructions embedded in these scraped titles could potentially influence the agent's behavior during the topic selection phase.
Ingestion points: Hot list scraping from Baidu, Toutiao, Zhihu, Bilibili, and 36Kr as described in references/pipeline-playbook.md.
Boundary markers: None identified for the scraping process.
Capability inventory: File system writes; subprocess execution (ffmpeg, ffprobe) in scripts/qa.py and scripts/clipcheck.py.
Sanitization: No explicit sanitization or validation of scraped titles was found in the provided documentation or scripts.

investigation-video