The Agent Skills Directory

[COMMAND_EXECUTION]: The helper script scripts/m4r_ingest.py executes system audio utilities (such as afplay, ffplay, or mpg123) to play downloaded tracks. These commands are invoked using argument lists via subprocess.run without a shell, which prevents command injection vulnerabilities.
[EXTERNAL_DOWNLOADS]: The skill fetches audio files and metadata manifests from the author's public GitHub repository (luchtan-GIT/m4r-data). These downloads are integral to the skill's purpose and originate from the vendor's own infrastructure.
[INDIRECT_PROMPT_INJECTION]: The skill ingests external data by reading JSON metadata and binary audio data into the agent's context. This ingestion point is considered safe as the resources are controlled by the skill author and the agent is provided with specific instructions for structural analysis. Mandatory Evidence Chain:
Ingestion points: Fetches catalog.json, manifest.json, and .mp3 files in scripts/m4r_ingest.py.
Boundary markers: No explicit boundary markers or ignore-instructions are used during data ingestion.
Capability inventory: Employs subprocess.run for audio playback and webbrowser.open for visualization links.
Sanitization: Uses standard json.loads for metadata parsing; audio data is processed as a raw signal.

mechanical-ear-critic