The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/gen_music.py uses subprocess.run to execute the ffmpeg utility for audio processing, including trimming, volume normalization, and applying fades to the generated music bed.- [DATA_EXFILTRATION]: The scripts/media_proxy.py module reads an API key and agent identifier from a local configuration file at ~/.gooseworks/credentials.json. These credentials, along with execution metadata and user-supplied music prompts, are transmitted to the vendor's diagnostic and billing endpoints (api_base). The script also implements a diagnostic logger (gw_log) that sends event details to a remote server.- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection.
Ingestion points: The --prompt argument in scripts/gen_music.py accepts untrusted data from the agent context.
Boundary markers: There are no delimiters or 'ignore' instructions wrapping the prompt data.
Capability inventory: The skill can execute shell commands via ffmpeg and perform network requests to external APIs.
Sanitization: No filtering or validation is performed on the prompt string before it is interpolated into the ElevenLabs API request payload.

create-music-elevenlabs