The Agent Skills Directory

[DYNAMIC_EXECUTION]: The script scripts/media_optimizer.py uses the eval() function to parse the r_frame_rate field returned by ffprobe (line 117).
Evidence: info['fps'] = eval(stream.get('r_frame_rate', '0/1'))
Risk: If a malicious media file is crafted such that its metadata contains executable Python code in the frame rate field, ffprobe may extract it and eval() will execute it on the host system.
[COMMAND_EXECUTION]: The skill relies heavily on executing external binaries via the shell.
Evidence: scripts/media_optimizer.py uses subprocess.run() to invoke ffmpeg and ffprobe for media processing.
Risk: While this is the intended functionality, it increases the attack surface if input filenames or parameters are not perfectly sanitized before being passed to the shell.
[PROMPT_INJECTION]: The skill is vulnerable to Indirect Prompt Injection (Category 8).
Ingestion points: scripts/document_converter.py and scripts/gemini_batch_process.py read content from untrusted external files (PDFs, images, videos) and send them to the Gemini API.
Boundary markers: The prompts generated in convert_to_markdown (line 155) lack strong delimiters or instructions to ignore embedded commands within the processed documents.
Capability inventory: The skill has access to Bash, Read, Write, and Edit tools.
Risk: A malicious PDF or video could contain hidden instructions that trick the LLM into executing dangerous shell commands through the agent's Bash tool.
[EXTERNAL_DOWNLOADS]: The skill uses the Google GenAI SDK to upload files to Google's File API.
Evidence: client.files.upload(file=file_path) in scripts/gemini_batch_process.py (line 134).
Risk: This involves sending local data to a remote service. While the service (Google) is well-known, users should be aware that their media files are being transmitted externally.

ai-multimodal