The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses subprocess.run to call external command-line tools such as ffmpeg, ffprobe, whisper-cli, and the macOS security utility. These tools are used for media duration probing, audio encoding, local transcription fallback, and retrieving API keys from the system keychain. Arguments are passed as lists without using a shell environment, which prevents shell injection vulnerabilities.
[EXTERNAL_DOWNLOADS]: The skill communicates with cloud ASR service providers to perform its core function. It makes network requests to dashscope.aliyuncs.com (Alibaba Cloud) and openspeech.bytedance.com (ByteDance). Both are well-known technology service providers, and these communications are necessary for the skill's stated purpose.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external audio/video files and user-supplied vocabulary files. Maliciously crafted content or metadata in these inputs could potentially influence an AI agent that subsequently processes the generated transcriptions.
Ingestion points: Processes media files and vocabulary JSON/TXT files through the scripts/voice2srt.py script.
Boundary markers: The skill does not currently insert explicit delimiters or safety warnings into the generated output files (SRT, JSON, TXT) to designate the content as untrusted transcription data.
Capability inventory: The skill can execute shell commands via media tools, perform network requests to cloud providers, and write artifacts to the local filesystem.
Sanitization: Input vocabulary files are parsed as structured JSON, and transcription results undergo text normalization and cleaning before output.

lov-voice2srt