The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The SKILL.md instructions guide the agent to install the edgespeak-cli using curl -fsSL https://edgespeak.com/install.sh | sh. Executing a remote script directly in a shell is a high-risk operation as it bypasses local verification and package management security controls.- [COMMAND_EXECUTION]: The bundled Node.js scripts (karaoke-ass.mjs and render-hardsub.mjs) dynamically construct and execute shell commands using execFileSync and spawnSync to call system binaries like ffmpeg, ffprobe, fc-match, and fc-list. This involves significant interaction with the host system's shell environment.- [PROMPT_INJECTION]: The skill possesses an attack surface for indirect prompt injection as it processes external transcription data. * Ingestion points: The loadTranscript function in scripts/karaoke-ass.mjs reads and parses JSON files containing user-controllable text and translations. * Boundary markers: None are defined; there are no instructions to the agent or scripts to ignore instructions embedded within the transcript content. * Capability inventory: The skill includes capabilities to write files to the disk and execute ffmpeg subprocesses. * Sanitization: The scripts use escapeAss for subtitle content and filterPath for FFmpeg filter paths to mitigate injection into the ASS format and FFmpeg filters.

edgespeak-karaoke