The Agent Skills Directory

[COMMAND_EXECUTION]: The script performs audio conversion by invoking the ffmpeg binary using spawnSync with an argument array. This approach is used to transform downloaded assets into the required MP3 format while avoiding shell-based injection vulnerabilities.\n- [EXTERNAL_DOWNLOADS]: Fetches audio metadata and media files from official Artlist infrastructure (artlist.io and search-api.artlist.io). These operations are consistent with the skill's purpose and target a well-known service provider.\n- [PROMPT_INJECTION]: The skill processes user-supplied search terms and file names without sufficient sanitization, creating an attack surface where maliciously crafted input could potentially influence file system operations via path traversal.\n
Ingestion points: CLI arguments term and name defined in SKILL.md and processed by the scripts/artlist-dl.mjs script.\n
Boundary markers: Absent; the skill does not utilize delimiters or warnings to isolate untrusted external data from its execution logic.\n
Capability inventory: Network access via native fetch, file system write and delete permissions, and subprocess execution of ffmpeg.\n
Sanitization: Absent; the name parameter is resolved directly into a file path using path.resolve without validation or filtering for traversal sequences like ../.

audio-sourcing