The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The skill instructs the user to run powershell -ExecutionPolicy Bypass -File scripts/make-release.ps1. This command explicitly disables standard security restrictions designed to prevent the execution of untrusted scripts on Windows systems.
[EXTERNAL_DOWNLOADS]: The skill's 'First Launch / Bootstrap' process automatically downloads several external binaries and tools, including ffmpeg, uv, Python 3.10, and multiple Machine Learning models (PyTorch, WhisperX, UVR Karaoke ONNX). These downloads occur from sources outside of standard system package managers and their integrity is not verified by the skill.
[COMMAND_EXECUTION]: The skill describes a complex build and execution environment that involves cloning a third-party GitHub repository (rzru/nightingale) and running locally built or downloaded binaries (e.g., ./target/release/nightingale, xattr -cr Nightingale.app).
[INDIRECT_PROMPT_INJECTION]: The skill has a significant data ingestion surface as it processes local audio and video files and fetches synchronized lyrics from the external LRCLIB API.
Ingestion points: SKILL.md describes the processing of local media files and data fetched from the LRCLIB external API.
Boundary markers: None specified in the instructions to separate untrusted data from the agent's logic.
Capability inventory: The skill performs file system writes to ~/.nightingale, executes subprocesses (ffmpeg, python, rust build tools), and performs network operations to fetch models and API data.
Sanitization: There is no evidence of sanitization or validation for content fetched from the external lyrics API or metadata embedded in media files.

nightingale-karaoke