The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill communicates with https://office-api-ist-dx.iflyaisol.com, which is the official API endpoint for iFlytek's ASR service. This is a well-known technology provider and the communication is required for the skill's primary function.
[DATA_EXFILTRATION]: The skill reads local audio files and uploads them to the iFlytek API for transcription. This behavior is transparently documented and aligned with the skill's purpose. No unauthorized access to sensitive system files or credentials was detected.
[CREDENTIALS_UNSAFE]: The script scripts/transcribe.py correctly retrieves API credentials (XFYUN_ASR_APP_ID, XFYUN_ASR_API_KEY, XFYUN_ASR_API_SECRET) from environment variables, avoiding hardcoded secrets.
[COMMAND_EXECUTION]: The skill executes a bundled Python script to perform transcription. The command line arguments are handled safely using the argparse library, minimizing the risk of command injection.
[PROMPT_INJECTION]: No malicious instructions or attempts to bypass agent safety guidelines were found in the skill metadata or instructions.
[INDIRECT_PROMPT_INJECTION]: The skill transcribes audio data which is then processed by the agent. While this presents an indirect prompt injection surface (where instructions could be hidden in audio), the risk is mitigated as the skill serves its intended purpose of text extraction.
Ingestion points: Local audio files read by scripts/transcribe.py.
Boundary markers: Absent.
Capability inventory: File-write capability via the --output parameter in scripts/transcribe.py.
Sanitization: None.

xfyun-asr