The Agent Skills Directory

[COMMAND_EXECUTION]: The CLI tool (scripts/opusclip) executes several system utilities including curl for API communication, jq for JSON processing, and ffmpeg for video manipulation (storyboarding and trimming). It also uses open or xdg-open to launch the default web browser.
[DATA_EXFILTRATION]: The upload command reads any local file provided and transmits it to the OpusClip API. This capability lacks restrictions, allowing a malicious actor or prompt injection to exfiltrate sensitive files like SSH keys or credentials from the agent's environment to the vendor's API.
[EXTERNAL_DOWNLOADS]: The skill downloads video preview files from URLs provided by the OpusClip API to the local /tmp directory. These are then processed using system commands like ffmpeg to generate storyboards or trimmed clips.
[PROMPT_INJECTION]: The skill ingests untrusted metadata and transcripts from an external API. This data is processed without clear boundary markers or sanitization, exposing the agent to indirect prompt injection where instructions in video content could influence its behavior. The agent's file-write and network capabilities heighten the risk associated with this vector.

opusclip