The Agent Skills Directory

[COMMAND_EXECUTION]: The skill interfaces with system utilities ffmpeg and ffprobe to perform media duration checks, audio extraction, and audio-video muxing. These operations are performed using subprocess.run with list-based arguments, which is a standard and secure method for media processing tasks.
[EXTERNAL_DOWNLOADS]: The skill makes network requests to external APIs including MiMo (api.xiaomimimo.com) and Fish Audio (api.fish.audio) for speech synthesis and recognition. It also supports communication with a user-configured index-tts endpoint. All network operations use timeouts and follow standard authentication patterns via environment variables.
[INDIRECT_PROMPT_INJECTION]: The skill processes narration text from local narration.json files and transcribes audio from source videos. Since this data is passed to external LLM-based services (TTS/ASR), it represents a potential indirect injection surface. However, the skill implements logic to strip reasoning-model leakage (e.g., <think> tags) from ASR results, mitigating potential LLM-specific artifacts.
[CREDENTIALS_SAFE]: The skill implements a robust sanitization utility _sanitize_api_error in scripts/lib.py. This function uses regular expressions to detect and redact API keys (matching patterns like sk- or tp-) and large data URLs from error messages before they are logged or returned to the user, preventing accidental credential exposure.
[SECURITY_PRACTICE]: For user-defined endpoints in the index_tts.py provider, the skill utilizes a custom _NoRedirectHandler. This handler explicitly disables HTTP redirects during synthesis requests, ensuring that sensitive narration text cannot be silently forwarded to an unauthorized third-party host if the configured endpoint is malicious or compromised.

video-voiceover