The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/colorize.py executes system commands via subprocess.run and subprocess.Popen to call ffmpeg, ffprobe, and sips. These tools are used to decode input media, extract metadata, and encode the final output video. While the implementation uses list-based arguments to minimize injection risks, it operates directly on file paths and data provided by the user.
[DYNAMIC_EXECUTION]: The skill embeds GLSL shader code (e.g., GRAD, MOTION, ROTATE, GLOW strings) which is compiled at runtime using the moderngl library's ctx.program() method. This allows the skill to perform complex image processing on the GPU but involves the dynamic generation and execution of code at runtime.
[INDIRECT_PROMPT_INJECTION]: The skill processes external, untrusted media files (images, videos, and motion photos) to generate its output. This creates an attack surface where maliciously crafted files could attempt to exploit vulnerabilities in the underlying media processing libraries or the agent's logic.
Ingestion points: Media files located at paths provided to the inputs argument in scripts/colorize.py.
Boundary markers: The skill does not implement specific sanitization or boundary markers for the contents of the processed files.
Capability inventory: The skill can read local files, execute system commands (ffmpeg, ffprobe), and write to the local file system (output MP4).
Sanitization: Input file paths are resolved to absolute paths using pathlib.Path, but the content of the files is not sanitized before being passed to media processing tools.

colorize