The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses subprocess.run and subprocess.Popen across several scripts (platform_download.py, lib/platform.py, setup_env.py, status.py, tidal_auth.py) to manage project setup and execute music downloaders (qobuz-dl, tiddl). These calls are implemented using list-based arguments, which follows security best practices to prevent shell injection.
[EXTERNAL_DOWNLOADS]: The setup utility (setup.sh, setup_env.py) installs established Python packages from the official PyPI registry, including spotipy, pylast, qobuz-dl, and tiddl. These are well-known libraries for interacting with music services.
[CREDENTIALS_UNSAFE]: The skill demonstrates good security posture by explicitly instructing the agent not to request user credentials in the chat. Instead, it utilizes a local .env file for secret management. The setup_config.py script employs the getpass library to securely prompt for passwords in the terminal.
[DYNAMIC_EXECUTION]: During the installation process, setup_env.py generates helper scripts (run.sh and run.bat) to automate the activation of the virtual environment. This is a standard convenience for developer-oriented tools.
[SAFE]: The download_ui.py component hosts a local web dashboard bound to 127.0.0.1. This provides a legitimate monitoring interface for long-running downloads and does not expose services to external networks.

hifi-download