The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill fetches audio data from remote sources as part of its core functionality.
Evidence: scripts/tts.py downloads reference audio files from default vendor URLs on noiz.ai or well-known cloud storage at storage.googleapis.com if no local file is provided.
Evidence: Both scripts/tts.py and scripts/render_timeline.py support downloading reference audio from arbitrary user-supplied URLs via CLI arguments or JSON configuration.
[COMMAND_EXECUTION]: The skill relies on several external command-line tools to process and play audio.
Evidence: It executes ffmpeg and ffprobe for tasks such as format conversion, duration matching, and timeline mixing in scripts/render_timeline.py.
Evidence: It calls the kokoro-tts binary for local offline synthesis when the Kokoro backend is selected.
Evidence: It attempts to use system utilities like afplay, aplay, or paplay to provide immediate audio playback for the user.
Note: These subprocess calls use list-based argument passing, which prevents shell command injection.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted input data that could potentially contain malicious instructions intended for the AI agent.
Ingestion points: Untrusted data enters via text files (--text-file, --input), SRT subtitle files (--srt), and JSON voice-map configurations (--voice-map).
Boundary markers: No delimiters or specific 'ignore instructions' warnings are applied to the ingested content.
Capability inventory: The skill has the capability to perform network requests (uploading text to Noiz API) and execute local commands (ffmpeg, kokoro-tts).
Sanitization: No sanitization or instruction filtering is performed on the input text before it is sent to the synthesis backends.

tts