The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/carve.mjs executes the ffmpeg command-line utility to perform audio decoding. It uses execFileSync to manage arguments, which provides protection against shell-level command injection, but the tool remains dependent on the presence and integrity of external system binaries.
[REMOTE_CODE_EXECUTION]: The utility employs dynamic module loading in its loadCore function. It uses the import() statement to load functionality from the @hyperframes/core package at runtime, with paths resolved dynamically based on the project's filesystem structure and package configuration. This represents dynamic code loading from computed paths.
[PROMPT_INJECTION]: The skill acts on local HTML composition files, reading and writing JSON-encoded data attributes. This processing of local file content represents an indirect prompt injection surface, where maliciously crafted composition files could attempt to influence the agent's actions or the script's execution flow.
Ingestion points: HTML composition files processed via the --comp parameter in scripts/carve.mjs.
Boundary markers: Absent; data is extracted directly from HTML attributes without explicit security delimiters.
Capability inventory: The skill can read/write local files, execute the ffmpeg binary, and dynamically import Node.js modules.
Sanitization: The implementation uses regular expressions for tag identification and standard JSON parsing for attribute data.

hyperframes-audio