The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts/monitor.py script interacts with the hermes CLI using subprocess.run. The implementation avoids shell execution by passing arguments as a list (e.g., ['hermes', 'kanban', 'list', '--tenant', tenant]), which effectively prevents command injection vulnerabilities.
[DYNAMIC_EXECUTION]: The assets/setup.sh.tmpl template includes an embedded Python script that patches Hermes profile configuration files at runtime. This script uses yaml.safe_load for secure parsing and receives its input via JSON-serialized strings, ensuring that configuration changes are handled safely without exposing the system to arbitrary code injection.
[INDIRECT_PROMPT_INJECTION]: The skill ingests user-provided video briefs to generate a project-specific team and task graph. It manages this attack surface through input validation (e.g., enforcing strict regex for profile names in scripts/bootstrap_pipeline.py) and by using templates that separate the agent's instructions from the project data.
[DATA_EXPOSURE]: The setup logic includes a helper function to verify the presence of required API keys in the environment or system keychain. This check is performed locally and uses output redirection to /dev/null to ensure that sensitive credentials are never leaked to logs or the terminal during the validation process.

kanban-video-orchestrator