The Agent Skills Directory

[COMMAND_EXECUTION]: The SDKs include a play() utility function designed for local audio playback that executes shell commands to invoke system tools.
Evidence in SKILL.md: "play() shells out to a system audio tool: Python uses ffmpeg/ffplay (or mpv), JS uses ffplay."
Evidence in references/installation.md: "The play() helper is for local/desktop use and shells out to a system tool."
[PRIVILEGE_ESCALATION]: The documentation provides a command for users to install system-level dependencies on Linux using sudo.
Evidence in references/installation.md: "sudo apt-get install ffmpeg"
[INDIRECT_PROMPT_INJECTION]: The skill enables the agent to ingest external audio and text data for processing by the Fish Audio API, which is a standard functional requirement for speech AI integration.
Ingestion points: Audio files provided to client.asr.transcribe and text strings provided to client.tts.convert across multiple reference files.
Boundary markers: The documentation does not specify explicit delimiters for untrusted data, though it advises against hardcoding keys.
Capability inventory: The skill utilizes network access to the vendor's API (api.fish.audio) and local file system writes via the save() utility.
Sanitization: No specific input sanitization is described; however, the data is transmitted to the official vendor service as intended.

fish-audio-sdk