The Agent Skills Directory

[COMMAND_EXECUTION]: The bundled utility scripts (e.g., scripts/preflight_audio.py, scripts/compare_audio.py) utilize subprocess.run to interface with external audio tools such as ffmpeg, ffprobe, and sox. While the script allows providing paths to these binaries via command-line arguments, it follows best practices by using list-based arguments instead of shell strings, which prevents common shell injection vulnerabilities.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted external data in the form of audio files. The forensic analysis includes extracting metadata (via ffprobe, exiftool, and mutagen) and analyzing signal characteristics. An attacker could embed malicious natural language instructions within audio metadata tags (such as 'Comment', 'Software', or 'Artist'). If an AI agent processes the generated forensic reports containing this unvetted metadata, it could be influenced by those embedded instructions.
Ingestion points: scripts/preflight_audio.py (reads audio file), references/forensic-metadata.md (extracts metadata using multiple tools).
Boundary markers: The skill does not explicitly define boundary markers or instruct the agent to ignore instructions embedded in the analyzed metadata.
Capability inventory: The skill possesses capabilities for file system access (read/write), command execution (ffmpeg, sox), and generating complex reports.
Sanitization: Metadata extracted from files is interpolated into report strings (e.g., in detect_metadata_anomalies) without explicit sanitization for natural language instructions.
[EXTERNAL_DOWNLOADS]: The documentation recommends the installation of several well-known third-party libraries and command-line tools (such as librosa, openai-whisper, ffmpeg, and sox) from official package registries (PyPI, Homebrew). All identified dependencies are standard, reputable tools within the audio forensics and machine learning domains.

audio-voice-recovery