The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill recommends installing the fal-client package from PyPI, which is the official SDK for the fal.ai service. This is a reference to a well-known service provider.
[DATA_EXFILTRATION]: The skill exposes internal environment details via hardcoded absolute file paths in the documentation and the Python CLI script (e.g., /Users/dobby/GitHub/scripts/sync/...), revealing the author's local file system structure.
[DATA_EXFILTRATION]: The Python script accesses a sensitive local file path (~/.secrets/fal/env) to retrieve authentication credentials for the fal.ai service. While this involves sensitive data access, it is the primary and documented method for authenticating with the intended service.
[PROMPT_INJECTION]: The skill provides a surface for indirect prompt injection by accepting user-supplied text and file references that are subsequently interpolated into API requests and used for local file system operations.
Ingestion points: User input is accepted through the --prompt, --prompt-file, --ref, --project, and --name arguments in fal_seedance_ref2v.py.
Boundary markers: There are no explicit delimiters or instructions to ignore embedded commands used when including these inputs in the API payload or path construction.
Capability inventory: The script performs network communication with fal.ai (uploading files, initiating video inference, and downloading results) and writes data to the local file system.
Sanitization: The script does not perform sanitization of the prompt text before transmission to the API, and the --project argument could potentially be used to influence file write locations.

fal-seedance