The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes ffmpeg and ffprobe to analyze and manipulate audio and video streams. The Python scripts (voiceprint.py, assemble-voice-change.py) invoke these tools using subprocess.run with argument lists rather than shell strings, which prevents command injection vulnerabilities.
[EXTERNAL_DOWNLOADS]: The match-voice.py script fetches audio previews from URLs provided by the Novoads API. The implementation includes significant security measures: it enforces HTTPS, utilizes the -- argument in curl to prevent option injection from malicious URLs, and hashes destination paths to prevent path traversal attacks.
[CREDENTIALS_UNSAFE]: The skill requires a NOVOADS_API_KEY stored in a .env file. It provides clear instructions for managing this secret and includes a setup script to verify its presence without exposing the value in logs or code.
[DATA_EXFILTRATION]: Audio and video content is transmitted to the vendor's API at api.novoads.ai for the purpose of voice conversion. This data flow is expected and restricted to the vendor's infrastructure.
[REMOTE_CODE_EXECUTION]: Automated scanners flagged a potential remote code execution risk due to the pattern of downloading files and then processing them with ffmpeg. Analysis confirms this is a safe implementation of a core feature, as the downloads originate from vendor-controlled endpoints and are processed as data rather than executed as code.
[PROMPT_INJECTION]: The skill ingests and transcribes user-supplied media files, which could theoretically contain malicious instructions. The risk is considered low because the agent uses the resulting text for specific word-for-word verification tasks rather than general command execution, and the integration scripts use secure argument passing.

change-voice