The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The create_task.py script accepts user-provided text via the --text argument to generate TTS audio for digital avatars. This input is interpolated into a JSON payload and sent to an external API.
Ingestion points: create_task.py via the --text command-line argument.
Boundary markers: No explicit delimiters or instructions are used to separate user content from API commands.
Capability inventory: The skill performs network POST requests to the chanjing.cc API.
Sanitization: Input is escaped through standard JSON encoding using json.dumps, but no content filtering is performed locally.
[DYNAMIC_EXECUTION]: Several scripts, including create_task.py, poll_task.py, upload_file.py, and get_upload_url.py, utilize __import__("os") to dynamically load the os module for environment variable access rather than using standard import statements. While the target module is static, this pattern is flagged as a dynamic execution technique.
[COMMAND_EXECUTION]: The _auth.py script uses subprocess.run to execute a local Python script open_login_page.py located in a sibling skill directory (chanjing-credentials-guard). This is used to trigger a browser-based login flow if credentials are missing. The execution is limited by a 5-second timeout and targeted to a specific internal path.

chanjing-avatar