The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes subprocess.run to execute ffmpeg commands for video frame extraction and video reassembly. These calls are implemented using list-based arguments without shell=True, which is a secure practice that prevents shell injection vulnerabilities.
[EXTERNAL_DOWNLOADS]: Media files can be retrieved from remote URLs. The implementation in scripts/glm_grounding_cli.py includes a security check _is_public_url that prevents Server-Side Request Forgery (SSRF) by validating that hostnames resolve to public IP addresses and blocking private or loopback ranges.
[DYNAMIC_EXECUTION]: To process coordinates and JSON results from model output, the skill uses ast.literal_eval and json.loads. These methods are safe for parsing string representations of data structures and do not allow for the execution of arbitrary code, unlike eval().
[CREDENTIALS_UNSAFE]: The skill manages the ZHIPU_API_KEY through environment variables. The setup utility follows security best practices by encouraging the use of a .env file and providing reminders to exclude it from version control using .gitignore.

glmv-grounding