The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied natural language prompts which are sent to the remote video editing model.
Ingestion points: The --prompt parameter and media file metadata in scripts/videogen.py serve as the primary entry points for untrusted data.
Boundary markers: None present; the skill interpolates the user prompt directly into the JSON request body sent to the API.
Capability inventory: The script performs network requests (API interaction, media uploads, result downloads) and file system operations (reading source media, writing output videos).
Sanitization: No specific filtering or escaping is applied to the prompt text before it is forwarded to the backend service.
[DATA_EXPOSURE_AND_EXFILTRATION]: The skill handles sensitive API credentials required to access the AI Hive service.
The videogen.py script manages the storage of an API key in ~/.ai-hive/config.json.
The script implements security best practices by explicitly setting the configuration file permissions to 0600 (read/write only by the owner), mitigating the risk of local credential exposure to other users on the system.
[EXTERNAL_DOWNLOADS]: The skill is designed to download generated video content from remote servers.
The script fetches results from URLs provided by the API response (resultUrl) and saves them to the user's local Downloads directory. These downloads are a core, intended function of the skill's primary purpose.

seedance-video-edit