The Agent Skills Directory

[PROMPT_INJECTION]: The skill processes arbitrary text inputs which introduces a surface for indirect prompt injection if the text originates from untrusted sources. 1. Ingestion points: The --text and --texts arguments in scripts/tts.mjs. 2. Boundary markers: No delimiters are used to separate instructions from data. 3. Capability inventory: The skill performs network operations to the Coze API and prints generated URLs to the console. 4. Sanitization: No input validation or escaping is performed on the provided text.
[COMMAND_EXECUTION]: The wrapper script scripts/tts.mjs utilizes the jiti library to dynamically import and execute logic from a path outside the skill directory (../../../src/skill-cli.ts). While this appears to be a standard project structure for the author, it involves dynamic loading of external code at runtime.

coze-tts