The Agent Skills Directory

[SAFE]: The skill does not contain any malicious code, obfuscation, or unauthorized data access patterns.
[COMMAND_EXECUTION]: The skill uses a bundled Python script (scripts/text_to_speech.py) to interact with the OpenAI API. The script is securely implemented, using the official SDK and validating all user-controllable arguments like voice names and output formats against strict allow-lists.
[CREDENTIALS_UNSAFE]: The skill follows security best practices by requiring the OPENAI_API_KEY to be provided via an environment variable and explicitly advising the user not to share it in the chat interface.
[EXTERNAL_DOWNLOADS]: The skill requires the openai Python package, which is a verified dependency from a well-known service provider.
[PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface as it processes untrusted user text. 1. Ingestion: User text input via --input or --input-file in scripts/text_to_speech.py. 2. Boundary markers: Absent. 3. Capability inventory: File writing and network requests to OpenAI API. 4. Sanitization: Input length is validated and capped at 4096 characters. This surface is considered safe for the intended purpose of text-to-speech generation.

speech