The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill automatically triggers the installation of several Python packages at runtime if they are not detected in the environment. This occurs in audio/scripts/lib/bgm.mjs and audio/scripts/lib/tts.mjs using python -m pip install -q for packages such as transformers, torch, google-genai, google-auth, and requests. While these are well-known libraries, automatic runtime installation without user confirmation is a security risk.
[DYNAMIC_EXECUTION]: The skill assembles and executes Python code at runtime. In audio/scripts/lib/bgm.mjs, a script for generating music (MusicGen) is constructed as a string literal and then executed via python -c. This script incorporates user-supplied intent or prompts through string interpolation. Although JSON.stringify is applied to the variables, dynamic code generation and execution remain significant attack vectors.
[CREDENTIALS_UNSAFE]: The skill reads several sensitive local files to manage authentication and configuration. These include ~/.heygen/credentials (for HeyGen API access), ~/.hyperframes/config.json (for project configuration), and various .env files that may contain API keys for ElevenLabs or Google services. While this access is required for the skill's primary functionality, it exposes user credentials to the execution context.
[INDIRECT_PROMPT_INJECTION]: The skill ingests a variety of untrusted external data, including natural language 'intent' descriptions, media files for transcription or grading, and .cube LUT files. These inputs are used to drive decision-making and are interpolated into commands. For example, scripts/audio-duck.mjs parses user-supplied composition HTML using regular expressions, and scripts/eval.mjs executes operations based on manifest data, creating a surface for potential indirect prompt injection attacks.

media-use