The Agent Skills Directory

[COMMAND_EXECUTION]: The skill contains a path traversal vulnerability in its file-writing logic. In scripts/cli.mjs, the ttsBySpeaker function resolves the output file path using the speaker variable without sanitization. A malicious input for the speaker name could be used to write files to arbitrary locations on the host system.
[COMMAND_EXECUTION]: The skill executes shell commands using the zx library. This includes running npm install during the initialization phase and ffmpeg within scripts/verify.mjs to perform audio validation.
[EXTERNAL_DOWNLOADS]: The skill relies on external network resources. The init command triggers an npm install, which downloads packages from the public NPM registry. Additionally, the skill communicates with api.fish.audio and dashscope.aliyuncs.com (an established service by Alibaba Cloud) to generate audio content.

tts