The Agent Skills Directory

[COMMAND_EXECUTION]: The skill invokes the ffmpeg utility via subprocess.run to convert audio recordings to the required 16kHz mono WAV format. This is implemented securely using a list of arguments rather than a shell string, effectively preventing command injection vulnerabilities.
[INDIRECT_PROMPT_INJECTION]: As the skill processes untrusted meeting audio and Zoom VTT transcripts, it is technically exposed to indirect prompt injection. However, this risk is well-mitigated by the human-in-the-loop design (requiring user confirmation for speaker labels) and the use of structured staging files to separate transcription data from instructions.
[SAFE]: The codebase demonstrates a strong security posture. Specifically, source_files.py uses pathlib.Path.resolve and is_relative_to to enforce that all file operations are restricted to the designated inbox directory. Additionally, voiceprints.py employs atomic file replacement using temporary files and os.replace to prevent data corruption during writes.

meeting-transcribe