The Agent Skills Directory

[COMMAND_EXECUTION]: The skill's Python scripts (assemble.py, tts_edge.py, make_subs.py) interact with system utilities such as ffmpeg, ffprobe, and fc-list using subprocess.run and subprocess.check_output. These calls are correctly implemented using lists for command arguments, which prevents shell injection vulnerabilities.
[EXTERNAL_DOWNLOADS]: The skill utilizes the edge-tts library to synthesize voice-over audio. This involves making network requests to Microsoft's official Edge TTS service. This activity is expected, well-documented, and targeted at a well-known service provider.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data via storyboard.json files to define video content and metadata. While this represents a potential attack surface for indirect prompt injection, the risk is mitigated as the scripts do not evaluate input strings as code and include basic sanitization for subtitle markup to prevent ASS tag injection.
[SAFE]: All third-party dependencies (pillow, numpy, edge-tts) are standard, reputable packages from official registries. The vendor-related links point to legitimate development repositories belonging to the skill's author.

ffmpeg-auto-assemble