The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill includes a Python script scripts/gen_cover.py that fetches generated images from external APIs, including OpenAI, Google Gemini, and GRSAI (a vendor-owned resource associated with bigfatsea). These are well-known and trusted services.
[COMMAND_EXECUTION]: The documentation instructs users and the agent to use uv run to execute the local helper script scripts/gen_cover.py. This is a standard method for running scripts within a managed environment and is intended for the skill's primary purpose of image generation.
[DATA_EXPOSURE]: The script scripts/gen_cover.py accesses environment variables (GRSAI_API_KEY, GOOGLE_API_KEY, OPENAI_API_KEY) to authenticate with external services. This is a secure and standard practice for managing API credentials compared to hardcoding secrets.
[INDIRECT_PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface as it ingests untrusted user material (audio, text, and photos) for distillation. However, the methodology includes a robust 'QA Report' (Step 7) which involves a 'fresh-eyes' check for safety, ethics, and narrative consistency, effectively mitigating the risk.
Ingestion points: SKILL.md Step 1 (Ingest & distill the material).
Boundary markers: The skill encourages the use of English square-bracket metatags (e.g., [Chorus: ...]) to separate instructions from content.
Capability inventory: Network access via gen_cover.py for image generation.
Sanitization: Step 1 includes 'Sensitive-content flags' and Step 7 includes a dedicated 'QA Report' to check for ethical handling and sensitive content.

audio-album-creator