The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The script scripts/manga_style_video.py explicitly disables SSL certificate verification by setting ssl_context.verify_mode = ssl.CERT_NONE. This allows an attacker to intercept the ARK_API_KEY sent in the HTTP Authorization header via a Man-in-the-Middle (MitM) attack.
[COMMAND_EXECUTION]: The script uses subprocess.run to execute the system curl command. It passes a video_url retrieved from the remote API directly to the command line, which introduces risks associated with executing external binaries and potential argument injection if the API response were compromised.
[EXTERNAL_DOWNLOADS]: The skill interacts with ark.cn-beijing.volces.com, which is the official API endpoint for Volcengine (ByteDance). While this is a well-known service provider, the lack of SSL verification significantly undermines the security of these downloads.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection (Category 8).
Ingestion points: User-provided video descriptions in the prompt argument within scripts/manga_style_video.py.
Boundary markers: None; user input is directly concatenated with internal style strings.
Capability inventory: Subprocess execution via curl and authenticated network requests.
Sanitization: No input sanitization or escaping is performed on the user prompt before it is sent to the AI model.

manga-style-video