The Agent Skills Directory

[COMMAND_EXECUTION]: The skill interpolates user-supplied variables like {topic}, {url}, and {text} directly into shell commands ($CMD_PREFIX create ...) without explicit sanitization or escaping. This allows for command injection if an attacker provides inputs containing subshell syntax (e.g., $(...)) or command delimiters. Additionally, the use of string substitution within the jq command for updating speakers (--argjson speakers '{"{language}": ["{speakerId}"]}') is unsafe as it allows shell-level manipulation before the JSON processor runs.
[INDIRECT_PROMPT_INJECTION]: The skill has a significant attack surface for indirect prompt injection.
Ingestion points: The skill accepts untrusted topic descriptions, reference URLs, and raw text blocks in Step 1.
Boundary markers: There are no protective delimiters or instructions to the model to ignore potential malicious prompts embedded within these inputs.
Capability inventory: The skill possesses the ability to execute shell commands via the listenhub CLI, perform network downloads via curl, and write to the file system.
Sanitization: No validation or filtering is applied to the user-provided data before it is passed to the generation process.
[EXTERNAL_DOWNLOADS]: The skill uses curl to download audio files from an audioUrl provided by the CLI. While the tool is a vendor resource, the output URL is dynamically generated based on untrusted user-provided reference materials, posing a risk of downloading unintended or malicious payloads if the generation service is manipulated.
[COMMAND_EXECUTION]: The instruction to "auto-install and auto-login" the CLI without manual user review represents a high-autonomy execution pattern that could lead to unauthorized code execution if the installation source is compromised.

podcast