The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill's installation metadata specifies fetching code from a third-party GitHub repository not associated with a known trusted vendor.
Evidence: github.com/steipete/sonoscli/cmd/sonos@latest is targeted for installation via the Go module system.
[REMOTE_CODE_EXECUTION]: The installation process involves downloading source code from an external repository, compiling it, and executing the resulting binary on the local system.
Evidence: The agent uses the binary installed via go install to perform all Sonos operations described in the skill.
[COMMAND_EXECUTION]: The skill relies on shell command execution to interact with local network devices.
Evidence: The skill defines numerous commands such as sonos discover, sonos volume set, and sonos queue clear which the agent must execute in the local terminal.
[CREDENTIALS_UNSAFE]: The skill handles sensitive Spotify API credentials, and the provided safety evaluation notes a high risk of exposure if guardrails are bypassed.
Evidence: References to SPOTIFY_CLIENT_ID and SPOTIFY_CLIENT_SECRET indicate the management of secrets within the execution environment.

sonoscli-hardened