The Agent Skills Directory

[SAFE]: The skill was audited for malicious patterns, including prompt injection, data exfiltration, and unauthorized privilege escalation. No such patterns were detected. The skill follows its declared purpose of content creation and uses secure programming practices.
[COMMAND_EXECUTION]: The skill uses subprocess.run and subprocess.check_output to invoke external media processing tools like ffmpeg, ffprobe, and remotion. All shell invocations use list-based arguments, which is the secure way to prevent command injection vulnerabilities from user-provided data.
[DATA_EXPOSURE]: User state and persistent preferences are stored in a dedicated hidden directory (~/.video-podcast-maker/). The skill implements strict path validation (using os.path.commonpath) and identifier slugification to ensure that project names or asset paths provided by the user cannot be used for directory traversal or unauthorized file access.
[EXTERNAL_DOWNLOADS]: Dependencies listed in package.json are well-known libraries from the Remotion ecosystem. The skill utilizes tools like hyperframes (authored by HeyGen) and sibling components authored by the same vendor (Agents365-ai), all of which are recognized as well-known or trusted services. No unvetted remote code execution patterns were found.

video-podcast-maker