The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The skill includes a configuration setting QWEN_AUDIO_AGENT_BACKEND_PERMISSION_MODE which can be set to full. This mode explicitly auto-approves all commands and file changes initiated by backend agents, removing the 'human-in-the-loop' safety mechanism and allowing for unrestricted system access.
[EXTERNAL_DOWNLOADS]: The documentation provides instructions to install the software directly from a GitHub repository (github.com/QwenAudio/qwen-audio-agent) rather than a verified package registry. Furthermore, the skill features an 'Auto-install' capability for multiple backend agents (such as OpenCode and OpenClaw) from external sources at runtime.
[COMMAND_EXECUTION]: The runtime supports a custom 'ACP Backend' via the ACP_COMMAND and ACP_ARGS configuration fields. This allows the skill to execute arbitrary shell commands on the host system as part of its primary operation.
[PERSISTENCE]: The skill provides built-in commands for service management (qwenaudio gateway install), which installs the gateway as a persistent user service that remains active across system restarts.
[INDIRECT_PROMPT_INJECTION]: The skill exhibits a significant attack surface for indirect prompt injection by ingesting and processing untrusted data from multiple sources.
Ingestion points: Untrusted content is ingested via voice input, background task results (e.g., web scraping or file analysis performed by backends), and local memory files (USER.md, frontend-memory.json).
Boundary markers: The instructions do not specify any boundary markers or delimiters to differentiate between user instructions and untrusted data retrieved by backend agents.
Capability inventory: The skill possesses extensive capabilities including arbitrary command execution, file system modification, and network access via its integrated backend protocols.
Sanitization: There is no evidence of sanitization or filtering of external content before it is interpolated into the agent's prompt or stored in its long-term memory.

qwen-audio-agent-voice-runtime