The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: Fetches synthesized audio data from ElevenLabs (api.elevenlabs.io), a well-known service. This is the primary function of the skill and does not involve executable code.
[COMMAND_EXECUTION]: Interfaces with system utilities such as macOS say, ffmpeg, afplay, and ffplay via subprocess calls. These executions use fixed argument lists and sanitize inputs using a slugify function and the -- argument delimiter, which effectively mitigates command injection risks.
[INDIRECT_PROMPT_INJECTION]: The skill processes agent outputs and user-provided text for speech generation. It includes a speakify function that cleans markdown, collapses code blocks, and shortens file paths, which reduces the potential for disruptive or malicious output strings being vocalized.
[CREDENTIALS_UNSAFE]: Resolves ElevenLabs API keys from standard environment variables and local configuration files (~/.elevenlabs/api_key). The logic also looks in a path specific to the author (~/broomva/.env.local), which is a standard pattern for developer-authored scripts and follows safe secret management practices.

talkback