The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes user-defined JSON sound maps and cue sheets. Analysis of scripts/sound-family.mjs and scripts/sound-check.mjs shows robust validation, including regex-based name checking, range validation for numeric parameters, and length limits for prompts. This minimizes the risk of schema confusion or potential exploitation through malformed data ingestion.
[EXTERNAL_DOWNLOADS]: The skill optionally interacts with the ElevenLabs API for audio generation. The implementation in scripts/sound-family.mjs follows security best practices by retrieving the API key from environment variables (ELEVENLABS_API_KEY) rather than hardcoding it. Interactions with well-known services like ElevenLabs and Stable Audio (HuggingFace) are documented and handled securely.
[COMMAND_EXECUTION]: The provided scripts invoke ffmpeg and ffprobe to process audio files. The arguments for these calls are controlled and derived from validated manifest data, effectively mitigating command injection risks.
[SAFE]: The skill emphasizes security and performance best practices, such as ensuring AudioContext is created within user gestures to avoid suspension issues and implementing path-traversal protection in file operations using a restricted inOut resolution function. No evidence of obfuscation, privilege escalation, or persistence was found.

khe-sound