The Agent Skills Directory

[COMMAND_EXECUTION]: The script tools/analyze-sound.mjs uses child_process.execSync to invoke ffmpeg for decoding various audio formats. This is a functional requirement for audio analysis and the command is constructed using quoted path arguments to provide basic protection against shell injection.
[EXTERNAL_DOWNLOADS]: The skill references the Tone.js library in references/tone-js.md, pointing to its official registry on NPM and the well-known unpkg.com CDN. These are trusted sources for web development dependencies.
[INDIRECT_PROMPT_INJECTION]: The skill workflow involves ingesting audio profiles generated by an external tool (analyze-sound.mjs), which constitutes a potential attack surface for indirect prompt injection.
Ingestion points: Analysis output from tools/analyze-sound.mjs pasted into the conversation (referenced in SKILL.md).
Boundary markers: The instructions do not define specific delimiters for the tool output, but suggest the agent look for specific sections like synthesis_suggestion.
Capability inventory: The skill includes the ability to execute ffmpeg via a local script and generates executable JavaScript for the Web Audio API.
Sanitization: No specific sanitization or validation of the tool's output is implemented before processing.

ui-sound-design