The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied prompt strings and interpolates them into JSON payloads for remote video generation on the fal.ai platform.
Ingestion points: Prompts are ingested via the --prompt and --prompt-file arguments in the scripts/fal_seedance_ref2v.py script.
Boundary markers: The script does not utilize delimiters or specific instructions to isolate user input, leaving the agent and the remote model susceptible to instructions embedded within the prompt.
Capability inventory: The skill has the capability to perform network requests to fal.ai (API calls and media uploads) and write files to the local filesystem (MP4 video files and JSON receipts).
Sanitization: The skill performs no escaping or content validation on the prompt strings before transmitting them to the external provider.
[DATA_EXFILTRATION]: The skill facilitates the flow of sensitive authentication data from the local environment to a remote service.
Evidence: scripts/fal_seedance_ref2v.py reads a secret API key (FAL_KEY) from the sensitive local path ~/.secrets/fal/env and transmits it to the fal.ai service for authentication.
Evidence: The script contains hardcoded absolute filesystem paths (e.g., /Users/dobby/GitHub/scripts/sync/...) which reveal the local directory structure of the development environment.
[EXTERNAL_DOWNLOADS]: The skill relies on external packages and downloads media content at runtime.
Evidence: The SKILL.md documentation instructs users to install the fal-client package from the official PyPI registry.
Evidence: The scripts/fal_seedance_ref2v.py script uses urllib.request.urlopen to download generated video files from fal.ai CDN URLs and save them to the local filesystem.

fal-seedance