The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes external tools and local scripts to perform its tasks. In scripts/analyze-beatgrid.py, the ffmpeg utility is invoked using a list-based subprocess.run call to decode audio files. This implementation follows security best practices by avoiding shell execution and passing arguments as a discrete list, which prevents command injection.
[EXTERNAL_DOWNLOADS]: The skill requires several standard libraries for audio and animation processing. Instructions in SKILL.md suggest installing librosa, numpy, and soundfile from the official Python package registry. Additionally, various HTML templates in the references/ directory load the GSAP and Three.js libraries from a well-known content delivery network (jsDelivr).
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user data, including audio files and project descriptions, to generate a video storyboard. The risk of indirect injection is mitigated because the primary analysis script (analyze-beatgrid.py) performs numerical signal processing (tempo and onset detection) rather than extracting interpretable metadata from the audio files. Furthermore, scripts/stage-assets.mjs implements a whitelist-based extension check (.jpg, .png, .mp4, etc.) to ensure only recognized media formats are staged for the project.
[SAFE]: The skill demonstrates safe coding practices. It includes a clear separation between instructions and data, uses vendored parsers for storyboard processing, and implements idempotency in asset staging scripts. All external resources originate from well-known technology providers and registries.

music-to-video