The Agent Skills Directory

[COMMAND_EXECUTION]: The script uses subprocess.run to call ffmpeg and ffprobe for audio processing. The arguments are passed as a list (not as a raw shell string) and the shell=True parameter is not used, which is a secure practice that prevents command injection vulnerabilities.
[EXTERNAL_DOWNLOADS]: The skill requires the shazamio Python library to communicate with the Shazam API. This is a standard dependency for the skill's stated purpose of music recognition.
[INDIRECT_PROMPT_INJECTION]: The skill processes external audio files and retrieves metadata (song titles, artist names) from the Shazam API. While this metadata is technically untrusted content that could be seen by an agent, the risk is minimal as the script primarily prints this information for the user and does not execute it or interpolate it into complex system prompts.
Ingestion points: Audio files provided as command-line arguments to recognize.py.
Boundary markers: None explicitly present in the script's output.
Capability inventory: File read access (audio clips), network access (Shazam API), and local command execution (ffmpeg/ffprobe).
Sanitization: Standard subprocess list-based argument passing provides inherent protection against shell-based injection.

song-recognition