The Agent Skills Directory

[COMMAND_EXECUTION]: Secure interaction with system media tools for video processing tasks.
The skill utilizes subprocess.run to execute ffmpeg and ffprobe for duration probing, frame sampling, and final video assembly across multiple scripts including scripts/recap_runtime.py, scripts/final_qc.py, and scripts/qc/mimo_report.py.
All subprocess calls are constructed using list-based arguments or are sanitized with shlex.quote to effectively mitigate the risk of shell injection.
[DATA_EXFILTRATION]: Controlled network communication with AI service providers and protection of sensitive credentials.
The skill communicates with xiaomimimo.com and fish.audio APIs to provide video understanding and narration services.
It includes a comprehensive redaction system in scripts/materials.py and scripts/qc_contract.py that automatically identifies and strips various credential formats (e.g., MiMo, OpenAI, AWS, and GitHub tokens) from generated artifacts to prevent accidental data exposure.
[DYNAMIC_EXECUTION]: Hardened implementation of a local-only dashboard server for run monitoring.
scripts/dashboard_server.py hosts a read-only server on the loopback interface (127.0.0.1) protected by DNS-rebinding guards (host/origin validation).
The server implementation uses strict path normalization in scripts/dashboard_io.py to prevent directory traversal and employs security headers such as a restrictive Content Security Policy (CSP) and X-Content-Type-Options.
[INDIRECT_PROMPT_INJECTION]: Mitigation of ingestion risks from model-generated data.
The skill processes potentially untrusted data from VLM and ASR models. This attack surface is addressed through the use of deterministic validation logic, strict schema enforcement in scripts/qc_contract.py, and a multi-phase orchestration flow that ensures human-in-the-loop checkpoints before final rendering.

video-recap