The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill instructions direct the agent to ingest content from external product pages to extract ingredients and claims (SKILL.md, Stage 1). This untrusted data is then used to generate song lyrics and music direction, creating a vulnerability surface.
Ingestion points: External product pages accessed via URL (SKILL.md).
Boundary markers: The instructions lack explicit delimiters or instructions to ignore malicious content embedded within the external pages.
Capability inventory: The skill has the capability to execute shell commands via scripts/song.py (subprocess.run), write files to the local filesystem, and generate prompts for external AI services like Suno and ElevenLabs.
Sanitization: There is no evidence of sanitization or validation of the retrieved web content before it is interpolated into prompts.
[COMMAND_EXECUTION]: The skill includes a helper script that executes external media tools via the shell.
Evidence: The scripts/song.py script uses subprocess.run() to call ffprobe and ffmpeg for audio duration detection and slicing (scripts/song.py, duration and cut functions). While the arguments are passed in list format, the file paths and timing values are derived from agent-controlled input.
[DATA_EXPOSURE]: The scripts/song.py script provides a mechanism to read the content of arbitrary local files.
Evidence: The lyrics command in scripts/song.py takes a file path as an argument and reads its entire contents (p.read_text()) to extract lyrics. If an attacker directs the agent to run this script on a sensitive file (e.g., .env or .ssh/id_rsa), the script will process and potentially reveal its contents in the output.

song-ad