The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The scripts/gen_music.py script downloads audio files from external URLs returned by the Fal CassetteAI API (requests.get(url).content). While the service is a specific music generation provider, it constitutes downloading content from a remote server.
[DATA_EXFILTRATION]: The script scripts/gen_music.py reads sensitive credentials from a .env file (FAL_API_KEY) and sets them as environment variables (FAL_KEY) before making network requests to an external API. While this is standard for API-driven skills, it involves handling sensitive API keys.
[COMMAND_EXECUTION]: The script scripts/beat_detect.py and references/example-music.py perform file system operations, including writing audio files and JSON manifests to disk. references/example-music.py also writes to an absolute file path on a specific user's system (/Users/shivsakhuja/...), which indicates hardcoded environment assumptions.
[INDIRECT_PROMPT_INJECTION]: The scripts/gen_music.py script uses a VIBES dictionary to construct prompts for an external AI music generator. User-provided briefs (documented in SKILL.md and tests/sample-input.md) are the primary input for determining which prompt to use, creating a surface where malicious input could influence the generated music prompts. Severity is LOW as it follows the skill's intended purpose.
Ingestion points: User briefs and source asset paths defined in SKILL.md and tests/sample-input.md.
Boundary markers: None detected; the skill relies on confirmation of inputs but lacks explicit delimiters for untrusted data.
Capability inventory: File writes, network requests (Fal API), and audio processing (librosa).
Sanitization: No evidence of input sanitization or filtering of the user brief before it influences the workflow.

find-music