The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute various CLI tools for audio asset management and processing. Evidence in rules/interpret-extract-source.md includes the use of npm pack <package-name>, tar -xzf, and ffmpeg commands for slicing audio files. Additionally, rules/pipeline-emit-and-render.md describes using node:fs/promises for file output operations.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data, creating an attack surface for indirect prompt injection. Ingestion points include user-provided audio files (*.wav, *.mp3, etc.) and JSON manifests associated with audio sprites, as specified in SKILL.md and rules/pipeline-detect-input.md. There are no explicit boundary markers or instructions to prevent the agent from executing instructions embedded in metadata or manifest content. The agent has capabilities for command execution and file writing, which could be exploited if malicious inputs are processed without sanitization.
[EXTERNAL_DOWNLOADS]: The skill suggests using the npm registry to fetch audio sprites. rules/interpret-extract-source.md provides steps for using npm pack to download packages containing audio data, which is an expected method for accessing assets from a well-known service registry.

create-sound