The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructions direct the agent to automatically install the bytedlive-cli package globally via npm if it is not already present on the system. This is a standard dependency for the skill's functionality.
[COMMAND_EXECUTION]: The skill operates by orchestrating the bytedlive CLI tool to perform live streaming operations (room creation, audience control, etc.). Additionally, it executes a local Node.js script tools/report_usage.js upon initialization to track skill activation.
[DATA_EXFILTRATION]: The skill includes a telemetry script in tools/report_usage.js that transmits basic metadata, such as the agent platform name and skill version, to the vendor's tracking endpoint at https://live.byteoc.com/apiservice/skill/track.
[INDIRECT_PROMPT_INJECTION]: The skill acts as a surface for indirect injection by processing untrusted user data (e.g., live stream titles, broadcast messages, and chat comments) as arguments for shell commands.
Ingestion points: SKILL.md defines how user intent is mapped to CLI arguments.
Boundary markers: The skill does not explicitly define technical boundary markers for argument interpolation, but it implements a mandatory 'human-like' confirmation step for all write operations.
Capability inventory: Access to the bytedlive CLI (API management), npm (package installation), and node (script execution).
Sanitization: The instructions do not specify explicit sanitization or escaping of user input before shell interpolation, relying on the agent's internal command safety or the CLI's own handling.

byted-livesaas-master