The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The Python script scripts/threejs_audio_asset.py makes network requests to the ElevenLabs API (https://api.elevenlabs.io/v1) to perform sound generation, text-to-speech, audio isolation, and voice conversion tasks.
[DATA_EXFILTRATION]: The skill transmits data externally to the ElevenLabs service, including the user's API key (passed via headers) and audio files (passed via multipart form data). Additionally, the skill instructs the agent to access environment configuration by executing a probing script (probe_asset_credentials.sh) located in the user's home directory under ~/.codex/skills/threejs-game-director/ or ~/.claude/skills/threejs-game-director/.
[COMMAND_EXECUTION]: The skill instructions direct the agent to execute several local commands using bash and python3 to interact with the asset generation tool and verify the presence of required API credentials.
[PROMPT_INJECTION]: The skill presents a surface for indirect prompt injection by processing untrusted external data.
Ingestion points: User-defined strings via the --prompt and --text arguments, and external audio files via the --input argument in scripts/threejs_audio_asset.py.
Boundary markers: None identified. The skill does not use specific delimiters or warnings to prevent the agent from interpreting instructions potentially embedded in the processed text or audio metadata.
Capability inventory: The skill has the capability to perform network requests (urllib.request), read local files (pathlib.Path.read_bytes), and write files to the filesystem (pathlib.Path.write_bytes).
Sanitization: While the script uses standard library functions like urllib.parse.quote and json.dumps for protocol handling, it does not implement sanitization or validation to filter malicious instructions from the input data.

threejs-audio-generator