claude-video/scripts
bradautomates 3c488688d1 Harden subprocess argv against option injection (#2)
- download.py: insert `--` before URL in yt-dlp argv so a `-`-prefixed
  string can never be parsed as a flag (e.g. --exec, --config-location).
  Tighten is_url to reject `-`-prefixed sources and require non-empty
  netloc.
- frames.py, whisper.py: resolve video/audio paths to absolute via
  Path.resolve() before passing to ffmpeg/ffprobe (which don't honor
  `--` as end-of-options), so a relative path starting with `-` can
  never be misinterpreted as a flag.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-05-09 08:13:32 +10:00
..
build-skill.sh Add commands/watch.md so /watch is callable via Claude Code plugin 2026-04-24 14:54:54 +10:00
download.py Harden subprocess argv against option injection (#2) 2026-05-09 08:13:32 +10:00
frames.py Harden subprocess argv against option injection (#2) 2026-05-09 08:13:32 +10:00
setup.py Fix Windows compatibility: encoding, installer hints, interpreter name 2026-04-24 17:22:51 +10:00
transcribe.py Initial commit: /watch skill v0.1.0 2026-04-24 14:40:34 +10:00
watch.py Fix Windows compatibility: encoding, installer hints, interpreter name 2026-04-24 17:22:51 +10:00
whisper.py Harden subprocess argv against option injection (#2) 2026-05-09 08:13:32 +10:00