The Agent Skills Directory

[PROMPT_INJECTION]: The skill processes external media via user-supplied URLs and local paths, creating an ingestion point for untrusted data. This constitutes an indirect prompt injection surface.
Ingestion points: Input parameters for video_workflow.py, mps_audit.py, mps_snapshot.py, and mps_transcode.py accept external URLs and file paths.
Boundary markers: SKILL.md includes a mandatory requirement for the agent to confirm all user-customizable parameters before execution.
Capability inventory: Scripts perform subprocess calls for orchestration, file system operations for uploading/downloading results, and network communication with Alibaba Cloud API endpoints.
Sanitization: The skill implements high-quality sanitization, including SSRF protection in mps_audit.py (private IP blocking and DNS rebinding verification) and path traversal checks in oss_download.py and oss_upload.py.
[COMMAND_EXECUTION]: video_workflow.py and health_check.py use the subprocess module to manage internal script execution and verify the aliyun CLI environment. These calls use argument lists rather than shell strings, mitigating command injection risks.
[SAFE]: Credential handling strictly adheres to security best practices by leveraging the official alibabacloud_credentials SDK and the default credential chain. The skill explicitly forbids hardcoding or manual extraction of AccessKeys.

alibabacloud-video-forge