The Agent Skills Directory

[DYNAMIC_EXECUTION]: In scripts/video_editor.py, the eval() function is used to parse the frame rate string (r_frame_rate) obtained from ffprobe. This represents a risk because eval() executes arbitrary code found within the string, and in this context, the string originates from the metadata of a user-supplied video file.
[INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied video files and extracts metadata that could contain malicious payloads designed to exploit the unsafe evaluation in the code.
Ingestion points: Video metadata (frame rate) processed by ffprobe in scripts/video_editor.py.
Boundary markers: The script does not implement any boundaries or instructions to ignore potential commands within the metadata.
Capability inventory: The skill has extensive access to shell execution via ffmpeg and ffprobe across all provided scripts.
Sanitization: There is no validation or sanitization of the r_frame_rate string before it is passed to the eval() function.
[COMMAND_EXECUTION]: All scripts in the scripts/ directory (audio_mixer.py, batch_processor.py, motion_graphics.py, quality_assessment.py, thumbnail_generator.py, timelapse_creator.py, and video_editor.py) make use of subprocess.run() to invoke FFmpeg utilities. While these calls use argument lists rather than shell strings (reducing risk), they represent a significant capability to execute external commands based on user-provided file inputs.

video-processing-editing