The Agent Skills Directory

[COMMAND_EXECUTION]: The skill includes Bash in its allowed-tools list. However, the instructions explicitly discourage running manual shell scripts, directing the agent to use specific, managed MCP tools instead.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest external data, including user-defined configuration files (mastering-presets.yaml) and audio file metadata. While this represents a potential attack surface for indirect prompt injection, the risk is mitigated by the skill's narrow focus on technical audio processing parameters.
Ingestion points: mastering-presets.yaml via load_override, and album metadata via find_album.
Boundary markers: Not explicitly defined for YAML or metadata parsing.
Capability inventory: File read/write, specialized audio processing tools (master_audio, analyze_audio), and bash access.
Sanitization: Not explicitly documented in the instructions.
[SAFE]: The skill employs path resolution via a dedicated tool (resolve_path), which helps ensure that file operations remain within the intended application directory structure (~/bitwize-music/), adhering to the principle of least privilege.

mastering-engineer