The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses subprocess.run to call ffmpeg and ffprobe for media processing, duration probing, and rendering. These calls use lists for arguments, which is a secure practice that prevents shell injection vulnerabilities. \n- [SAFE]: The skill ingests narration and overlay data from tts_meta.json and visual_overlays.json. It implements character escaping (e.g., colons and single quotes) to sanitize this input before it is interpolated into FFmpeg filter strings, mitigating injection risks. \n- [SAFE]: The JianYing exporter in scripts/jianying_writer.py includes validation checks to prevent directory traversal attacks (ZipSlip) when extracting resource archives. It also removes hardware fingerprints from exported project metadata to preserve user privacy. \n- [SAFE]: Hardcoded API URL constants for the MiMo service in scripts/lib.py are configuration defaults and do not involve unauthorized network operations or exfiltration within the scope of this skill's execution.

video-assemble