The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to construct and execute shell commands (uv run mlx_audio.tts.generate) using text derived from external URLs or user input. The implementation uses double-quoted string interpolation (--text "Your response text") which is vulnerable to shell metacharacters (e.g., backticks, command substitution, or escaping the quotes) if the input text is not perfectly sanitized by the agent.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from the web through its "read it to me" feature, creating a potential attack surface where malicious content could override agent instructions.
Ingestion points: Content is fetched from arbitrary URLs via the WebFetch tool as described in SKILL.md under the "Read URL Content" section.
Boundary markers: The skill does not define explicit delimiters or boundary markers for fetched content, relying instead on the agent to "summarize aggressively."
Capability inventory: The skill has the ability to execute shell commands (uv run, rm) and write/delete files in the /tmp/ directory.
Sanitization: The instructions recommend stripping HTML and omitting sensitive values but lack robust technical sanitization (like shell escaping) for the text before it is interpolated into the TTS command.
[EXTERNAL_DOWNLOADS]: The skill downloads the mlx_audio package and a 500MB voice model from Hugging Face (mlx-community/chatterbox-turbo-fp16) during its initial run. While these are reputable community sources for the MLX framework, they represent external code and data dependencies executed locally.

audio-reply