The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructions generate complex shell commands for video processing using the Bash tool. There is a lack of explicit sanitization or boundary markers for user-provided variables such as $INPUT, $OUTPUT, and $PROD. If these variables are populated with malicious strings (e.g., shell metacharacters), it could lead to unintended command execution.
[REMOTE_CODE_EXECUTION]: The skill uses python3 -c to execute inline Python code for JSON parsing and references a local script _scripts/pip-crop-detect.py. While the inline script is hardcoded and performs a safe operation (JSON loading), the reference to an external local script represents a dependency on local file presence.
[DATA_EXFILTRATION]: No evidence of data exfiltration was found. All commands operate on local files and temporary directories (/tmp/, /dev/null), and no network-enabled tools or external URLs are referenced for data transmission.
[PROMPT_INJECTION]: The skill contains standard instructional guidelines and 'Non-Negotiable Rules' related to technical specifications (e.g., chroma key colors, aspect ratios). It does not contain patterns attempting to bypass agent safety filters or override system prompts.

c-ffmpeg