The Agent Skills Directory

[SAFE]: The skill exclusively communicates with the official vendor infrastructure (api.varg.ai, mcp.varg.ai, and s3.varg.ai) for image, video, and music generation tasks. These operations represent the core functionality of the skill provided by the author.
[COMMAND_EXECUTION]: The skill utilizes a local shell script (scripts/assemble.sh) to perform video concatenation and audio mixing via ffmpeg and ffprobe. The script is well-structured, uses safe temporary directory creation, and handles media processing parameters correctly. This execution is limited to legitimate media assembly tasks.
[SAFE]: Sensitive data management follows standard practices: the skill instructs the use of a VARG_API_KEY stored in an environment variable for authenticated requests to the vendor API, rather than hardcoding credentials.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a potential attack surface by interpolating untrusted user data (such as names, ages, and personal details) into natural language prompts for remote AI models.
Ingestion points: User input collected during the "Ask five things" phase in SKILL.md.
Boundary markers: None identified; input is directly inserted into prompt templates.
Capability inventory: Subprocess calls to ffmpeg and curl are present in scripts/assemble.sh and SKILL.md.
Sanitization: No specific sanitization or escaping of user-provided strings is performed before interpolation into prompts.
[SAFE]: The skill incorporates clear safety and ethical protocols, specifically regarding consent for facial animation and voice cloning, as well as strict privacy rules for content involving children.

varg-birthday-video