The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts/build_mix.py script utilizes subprocess.run to invoke the ffmpeg command-line utility for audio decoding and processing. The implementation is secure as it passes arguments as a list and does not enable shell execution, preventing command injection vulnerabilities.
[EXTERNAL_DOWNLOADS]: The skill instructions describe installing standard Python dependencies (numpy, scipy) via pip and running a QA tool via npm. It also references a script (generate-sfx.py) assumed to be available in a sibling skill directory. These are functional requirements for the audio engineering tasks and originate from legitimate development tools.
[INDIRECT_PROMPT_INJECTION]: The skill has a data ingestion surface by processing external MP4/WAV files and their transcriptions (via Whisper API). While these external inputs could theoretically contain adversarial content intended to influence the agent's behavior, the skill's logic is constrained to signal processing (reverb, equalization, level matching), which naturally limits the risk of an injection escalating to unauthorized actions.

ai-audio-sound-design