The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill downloads the uv package manager installer from https://astral.sh/uv/install.sh. This originates from a well-known technology provider.
[EXTERNAL_DOWNLOADS]: The installation process involves cloning a third-party source code repository from https://github.com/fikrikarim/parlor to the local environment.
[REMOTE_CODE_EXECUTION]: The skill provides instructions to download and execute a shell script using the command curl -LsSf https://astral.sh/uv/install.sh | sh. This pattern executes the uv installer directly from a remote server.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process real-time multimodal data (audio PCM and JPEG frames) which acts as an untrusted input vector.
Ingestion points: Raw audio and image data are received through the FastAPI WebSocket endpoint /ws in server.py and passed directly to the Gemma 4 inference engine.
Boundary markers: The provided code snippets do not show any delimiters or instruction-ignoring prompts to isolate the user's audio/visual content from the system prompt.
Capability inventory: The skill has the capability to write to the local filesystem (for model storage), open network ports for the WebSocket server, and execute Python code via uv run.
Sanitization: There is no evidence of pre-processing, filtering, or sanitization of the audio or visual data streams before they are analyzed by the LLM.

parlor-on-device-ai