The Agent Skills Directory

[COMMAND_EXECUTION]: The skill extensively uses subprocess.run() in scripts like renderer.py, dj_effects.py, and music_analyzer.py to call system tools such as ffmpeg, ffprobe, and npx. These commands are executed using argument lists to mitigate shell injection risks, though they do incorporate user-supplied strings like project titles and search terms.
[EXTERNAL_DOWNLOADS]: The music_downloader.py script programmatically searches for and downloads MP3 files from gequbao.com. While this domain is not a recognized trusted service, the download is directly related to the skill's purpose of providing background music for generated videos.
[INDIRECT_PROMPT_INJECTION]: User-supplied inputs for video themes and lyrics are interpolated into prompts for downstream AI generation (e.g., in storyboard_generator.py). The current implementation lacks rigorous sanitization or boundary delimiters for this untrusted data, presenting a potential surface for indirect prompt injection.
[DYNAMIC_EXECUTION]: The skill architecture relies on the dynamic execution of local Python sub-scripts and system CLI tools at runtime to manage asset fetching and video rendering. While standard for this complexity, it involves the runtime coordination of multiple processes.
[SAFE]: The skill correctly manages third-party service credentials (such as Suno and Pexels API keys) by instructing the user to store them in environment variables rather than hardcoding them in the source code.

mv-skill