The Agent Skills Directory

[SAFE]: The skill implements legitimate audio synthesis functionality using Bytedance's official Samiproduct APIs.
[CREDENTIALS_UNSAFE]: The skill manages sensitive API keys by reading from environment variables and persisting them to a .env file. It follows security best practices by applying restricted file permissions (0o600) to the secret file and does not contain hardcoded credentials.
[EXTERNAL_DOWNLOADS]: Network operations are restricted to vendor-owned domains (e.g., openspeech.bytedance.com) for audio generation and API key management, which is consistent with the skill's purpose.
[DATA_EXFILTRATION]: Input data (text and URLs) is sent only to the designated vendor endpoints. No unauthorized data transmission to third-party domains was detected.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted content through the text and input_url parameters in scripts/podcast.py. While boundary markers and sanitization are absent, the risk is negligible as the agent's capabilities are limited to generating audio files and returning vendor-hosted URLs, with no high-privilege operations performed on the ingested data.

byted-podcast-gen