The Agent Skills Directory

[OBFUSCATION]: The skill employs a polyglot file technique to circumvent platform security controls in the html_render tool. It prepends a PNG file signature (\x89PNG\r\n\x1a\n) to MP3 audio data and uses a .png file extension to trick the platform's image-only inlining mechanism. The generated HTML then uses JavaScript to decode this data and remove the fake header at runtime.
[DATA_EXFILTRATION]: The script speak.py accesses and reads sensitive session transcript files located at ~/.claude/projects/*/{session}.jsonl. These files contain the full history of conversation turns. The extracted text is then transmitted to the external OpenAI API (api.openai.com) for speech synthesis. While this is a well-known service, the automated extraction of session history from the filesystem is a significant data access pattern.
[INDIRECT_PROMPT_INJECTION]: The skill exposes an attack surface by ingesting untrusted data from conversation history, exposing a potential attack surface.
Ingestion points: Conversation history is retrieved from ~/.claude/projects/*/{session}.jsonl via the last_reply() function.
Boundary markers: None. The script processes transcript content directly as text for speech synthesis.
Capability inventory: The skill can perform network operations (api.openai.com), write to the local filesystem (~/.cache/t3-voice/), and invoke the html_render tool.
Sanitization: The speakable() function attempts to sanitize inputs by stripping Markdown, code blocks, URLs, and file paths.
[COMMAND_EXECUTION]: The agent is instructed to execute the local Python script speak.py via a shell command using a heredoc, piping transcript or reply text into the subprocess.
[DYNAMIC_EXECUTION]: The skill generates and injects JavaScript code into the agent's UI via the html_render tool. The script in the PLAYER template dynamically creates a Blob and a URL object at runtime to facilitate audio playback from the disguised PNG file.

t3-voice