The Agent Skills Directory

[DATA_EXFILTRATION]: The scripts generate_bgm.py and setup_key.py explicitly search for and read API tokens from configuration files belonging to other related skills (e.g., sound-effects, avatar-video-reel, and brand-asset-studio) located in the user's home directory. This constitutes cross-skill data exposure.
[COMMAND_EXECUTION]: The skill uses subprocess.run to invoke ffmpeg and ffprobe for audio post-processing, such as applying fade-in/fade-out effects and checking file duration. These calls use list-based arguments which mitigate common shell injection risks.
[PROMPT_INJECTION]: The enhance_prompt function in generate_bgm.py takes user-supplied descriptions and interpolates them directly into a prompt string for the ElevenLabs Music model. This represents an indirect prompt injection surface where untrusted data enters the agent context.
[EXTERNAL_DOWNLOADS]: The skill downloads generated audio files from Replicate's servers using urllib.request.urlretrieve once the model processing is complete.

bg-music