The Agent Skills Directory

[COMMAND_EXECUTION]: The skill relies on local shell utilities including adb, ffmpeg, awk, and grep to interact with a connected Android device and manipulate audio files. These commands are necessary for the skill's stated purpose of call recording management.
[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by processing untrusted data (filenames) retrieved from an external mobile application.
Ingestion points: External filenames are retrieved from the Android filesystem using the adb shell ls command in SKILL.md.
Boundary markers: Absent. There are no delimiters or instructions provided to the agent to treat filenames as potentially unsafe or to ignore embedded control characters.
Capability inventory: The ingested filenames are passed to adb pull, ls, and ffmpeg via shell loops and awk scripts.
Sanitization: While basic shell quoting is used in some loops, the awk script that generates the ffmpeg concatenation file (awk '{ printf "file %s\n", "\x27"$0"\x27" }') is vulnerable to filenames containing single quotes, which could lead to command failure or data corruption during audio processing.

ccr-import