The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses a local Python script (scripts/sora.py) to interface with the Sora API. The script is well-structured, uses standard libraries like argparse, and does not employ dangerous functions such as eval(), exec(), or subprocess.run() for arbitrary commands.
[EXTERNAL_DOWNLOADS]: The skill downloads video assets, thumbnails, and spritesheets from OpenAI's official API endpoints. These operations are part of the intended functionality and target trusted infrastructure.
[CREDENTIALS_UNSAFE]: Authentication is handled via the OPENAI_API_KEY environment variable. The skill documentation explicitly instructs the agent not to ask for the key in chat, which is a significant security best practice.
[PROMPT_INJECTION]: The instructions include clear 'Guardrails' that the agent must enforce, such as prohibiting the generation of copyrighted content, real people, or content unsuitable for minors.
[DATA_EXFILTRATION]: Network access is used solely for communication with OpenAI's API. There is no evidence of the script accessing sensitive local files (like SSH keys or AWS credentials) or sending data to unknown third-party domains.

sora