The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the user to clone the victordibia/handtracking repository from GitHub. While GitHub is a well-known service, the specific repository is managed by an individual and is not part of the trusted organization list.
[REMOTE_CODE_EXECUTION]: The documentation indicates that a pre-trained model file (~20MB) is automatically downloaded from a remote source when the detector is first initialized. Fetching and loading unverified binary blobs at runtime is a potential vector for code execution.
[COMMAND_EXECUTION]: The installation and usage instructions provide several shell commands for environment setup and execution, including git clone, pip install, and executing the downloaded Python scripts via python run.py.
[INDIRECT_PROMPT_INJECTION]: The skill processes external, untrusted video data from files or live webcam streams, presenting a vulnerability surface if the agent reacts to embedded visual instructions.
Ingestion points: Processes external video files (e.g., egocentric_video.mp4) and live webcam streams.
Boundary markers: No boundary markers, delimiters, or 'ignore embedded instructions' warnings are implemented in the provided code snippets.
Capability inventory: The skill utilizes cv2.imwrite and cv2.VideoWriter to save images and video files to the local file system.
Sanitization: No input validation or integrity checks are performed on the video frames or streams before processing.

handtracking