The Agent Skills Directory

[SAFE]: The skill's primary function is to process images and text into video thumbnails using local Python scripts. It does not exhibit any malicious patterns such as credential theft, data exfiltration, or unauthorized command execution.
[COMMAND_EXECUTION]: The skill involves executing local Python scripts (cutout.py and render.py) and standard setup commands (pip install, playwright install). These are documented and necessary for the skill's functionality.
[EXTERNAL_DOWNLOADS]: Dependencies like rembg and playwright may download necessary assets, such as machine learning models and browser binaries, from their official sources upon first use. This is standard behavior for these well-known libraries.
[INDIRECT_PROMPT_INJECTION]: The skill processes user-provided strings (titles, subtitles) for image generation. Analysis of src/render.py confirms that user input is properly sanitized using html.escape() before being interpolated into HTML templates and rendered via Playwright, effectively mitigating potential injection attacks within the browser context.

yyl-video-thumbnail