The Agent Skills Directory

[COMMAND_EXECUTION]: The skill relies on the Bash tool to execute local scripts such as music_engine.sh, preflight.sh, and detect_gpu.sh. These scripts are located in the user's home directory (~/.claude/skills/claude-music/scripts/).
[PROMPT_INJECTION]: The skill exhibits a surface for indirect prompt injection by interpolating untrusted user data into shell command arguments. If a user provides a caption or lyrics containing shell control characters (like ;, |, or backticks), it could result in unauthorized command execution.
Ingestion points: User-provided descriptions and lyrics are mapped to the --caption and --lyrics flags in SKILL.md.
Boundary markers: No specific delimiters or safety instructions are provided to the agent to distinguish between data and instructions within the command string.
Capability inventory: The skill explicitly allows the Bash tool and performs shell script execution.
Sanitization: The instructions do not specify any sanitization, escaping, or validation steps for the user-supplied strings before they are passed to the Bash tool.

claude-music-generate