The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/insert_3d_transition.py executes multiple external binaries including ffmpeg, ffprobe, and npx. While it uses list-based arguments for subprocess.run to prevent shell injection, the --bg-color argument is directly interpolated into an FFmpeg filter string (color=c={bg_color...}). An attacker could potentially inject additional FFmpeg filters by providing a value containing colons or other filter delimiters.
[EXTERNAL_DOWNLOADS]: The skill requires the installation of Node.js dependencies via npm install and executes npx remotion, which may download the Remotion package from the public npm registry if it is not present. These are standard operations for the Remotion framework and target well-known repositories.
[PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection by processing untrusted external data.
Ingestion points: The script reads user-provided file paths for input_video and bg_image, and processes output from ffprobe.
Boundary markers: None are present; the agent processes the file paths and contents directly as part of the media pipeline.
Capability inventory: The skill performs file system reads/writes and executes complex media processing commands using ffmpeg, ffprobe, and npx.
Sanitization: The script lacks validation for the internal structure or metadata of the video/image files, and the bg_color string is not sanitized against filter injection.

pan-3d-transition