The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides templates for shell commands that interpolate user-supplied data without explicit sanitization instructions. In SKILL.md (Section 2.1) and rules/interpret-extract-source.md, variables like <package-name>, <start_seconds>, and <name> are used in shell commands for npm pack, tar, and ffmpeg. An attacker could potentially craft a prompt or provide a malicious audio manifest to inject arbitrary shell commands if the agent does not sanitize these inputs.
[EXTERNAL_DOWNLOADS]: The instruction set explicitly directs the agent to download external packages from NPM using npm pack <package-name> to extract audio sprites. While targeting a well-known registry, downloading arbitrary packages based on user input carries inherent supply-chain risks.
[INDIRECT_PROMPT_INJECTION]: The skill has a significant attack surface for indirect prompt injection as it processes external audio files and JSON manifests.
Ingestion points: Audio files (WAV, MP3, etc.), sprite manifests (JSON), and natural language prompts.
Boundary markers: The instructions lack specific boundary markers or warnings to the agent to disregard instructions embedded in audio metadata or manifest fields.
Capability inventory: The skill uses shell execution (ffmpeg, npm, tar, node, python) and file system writes (writeFile).
Sanitization: There is no mention of escaping or validating user-supplied strings before they are passed to the shell or interpolated into generated TypeScript snippets.

create-sound