The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests user-provided text to construct prompts for the Sora video API. While it employs a structured template in scripts/sora.py, it does not utilize explicit boundary markers or delimiters for user input, which is a standard surface for indirect prompt injection where malicious instructions in the input might influence the agent's behavior.
Evidence:
Ingestion: User prompts via --prompt or --prompt-file arguments.
Capabilities: The agent has network access to the OpenAI API and local file system write access for video assets.
Sanitization: No explicit content filtering or escaping of user strings is performed before interpolation into the prompt template.
[COMMAND_EXECUTION]: The skill relies on the execution of a local Python script (scripts/sora.py) to perform its primary functions. The script correctly limits file operations to paths provided as arguments and includes checks for existing files.
Evidence:
Script Path: scripts/sora.py is invoked using uv run or python as described in references/cli.md.
Operations: The script performs file reads (prompts/images) and writes (JSON job details and binary video data).
[EXTERNAL_DOWNLOADS]: The skill facilitates the download of video and image assets from OpenAI's official API domains (api.openai.com).
Evidence:
The download command in scripts/sora.py fetches content from OpenAI's video delivery infrastructure, which is a well-known service.

sora