The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses subprocess.run to call system utilities such as ffmpeg and ffprobe for video processing and quality checks. It also orchestrates the execution of internal Python scripts within the skill bundle (e.g., video-understanding, video-cut, video-voiceover). These calls use argument lists rather than shell strings, reducing the risk of command injection.
[EXTERNAL_DOWNLOADS]: The skill interacts with external API endpoints (primarily xiaomimimo.com and api.fish.audio) for video understanding, ASR (Automatic Speech Recognition), and TTS (Text-to-Speech) services. These are the core services required for the skill's stated purpose.
[DATA_EXFILTRATION]: The skill implements a material library feature in scripts/materials.py that copies analysis artifacts to a persistent directory for reuse. While it includes a _redact_json mechanism to mask common credential patterns (API keys, JWTs), the skill documentation explicitly notes that this redaction is "best-effort" and may miss unrecognized secret formats, posing a potential risk of sensitive data being copied to the library.
[INDIRECT_PROMPT_INJECTION]: The skill ingests data from untrusted sources, including video audio (via ASR), video frames (via VLM), and external research documents. These outputs are interpolated into prompts for the agent, creating a standard attack surface for indirect prompt injection where malicious instructions could be embedded in the video content or research data.
[CREDENTIALS_UNSAFE]: The skill manages API keys (e.g., MIMO_API_KEY, FISH_API_KEY) via environment variables. It includes diagnostic logic in scripts/doctor.py to verify key configuration and validation logic to prevent credentials from being passed in specific URL fields (e.g., the INDEX_TTS_ENDPOINT).
[DATA_EXPOSURE]: The skill's final_qc.py script specifically filters ffprobe metadata, selecting only necessary technical fields and discarding container tags (such as comments or PURL URLs) to prevent information leakage from source videos into generated reports.

video-recap