The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied text prompts and image URLs which are passed to external AI video generation models.
Ingestion points: The --prompt and --image-url arguments in tools/generate.js accept arbitrary external data.
Boundary markers: There are no explicit delimiters or instructions to the model to ignore embedded commands within the user prompt.
Capability inventory: The tools/generate.js script performs network operations (fetch) to send data to the proxy, and the proxy interacts with several external AI model providers (MiniMax, Kling, Google Veo, Grok, etc.).
Sanitization: Input strings are only subjected to basic whitespace trimming (.trim()) before being sent to the AI backends.
[DATA_EXFILTRATION]: By default, the tools/generate.js utility transmits user prompts and image URLs to a hosted proxy service (video-gen-proxy.vercel.app). While this is the intended functionality for a zero-setup experience, users should be aware that their content is processed by this external endpoint unless they choose to deploy their own instance of the provided proxy code.
[COMMAND_EXECUTION]: The skill uses a Node.js script (tools/generate.js) as the primary interface for the agent. This script handles command-line arguments and performs network requests. This is standard for utility-based skills but requires the agent to have execution permissions for the script.
[CREDENTIALS_UNSAFE]: The proxy implementation uses environment variables for secret management, which is a secure practice. However, the statistics dashboard endpoint (/api/stats) is protected by an optional STATS_KEY. If a user deploys this proxy without setting the STATS_KEY, usage metadata including generation counts and model preferences would be publicly accessible via the /api/stats?ui=1 interface.

videoagent-video-studio