The Agent Skills Directory

[COMMAND_EXECUTION]: The helper script scripts/generate_voice.py processes several command-line arguments (--text, --text-file, --config, --output) that influence file system reads and writes. While the script uses standard Python libraries for file operations, a malicious user could potentially provide paths to sensitive files (e.g., .ssh/id_rsa) via the --text-file argument, which would then be read and sent to the ElevenLabs API as the text-to-synthesize.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to process external text files (--text-file) and stdin. These inputs are not sanitized before being sent to the ElevenLabs API. While ElevenLabs is a TTS service and not an LLM, the downstream output (audio) could contain injected instructions if the generated audio is later processed by other AI agents or systems (audio-to-text-to-action chains). The skill lacks explicit boundary markers or warnings about processing untrusted content.

elevenlabs-tts