The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill implements a secure credential lookup pattern. The scripts gen-music.mjs and gen-sfx.mjs are designed to read the ELEVENLABS_API_KEY from environment variables or a local .env file, expressly advising against hardcoding sensitive tokens within the code.
[COMMAND_EXECUTION]: The automation scripts invoke system utilities ffmpeg and ffprobe to perform audio analysis and normalization. These invocations use the spawnSync pattern with argument arrays, which effectively prevents common shell-based command injection vulnerabilities even when processing user-defined filenames or prompts.
[EXTERNAL_DOWNLOADS]: The skill makes network requests to the ElevenLabs API (api.elevenlabs.io) for audio generation. This behavior is consistent with the skill's primary function and targets a well-known service.
[INDIRECT_PROMPT_INJECTION]: The skill ingests user-supplied data from configuration files (like kit.json) and command-line arguments to build prompts for the audio generation API. The scripts incorporate safety heuristic checks to warn against prompts that might violate service terms, and the execution capabilities are narrowly scoped to media processing utilities, minimizing the impact of potential injection attacks.

sound-design