The Agent Skills Directory

[SAFE]: The skill was analyzed for malicious patterns across all 11 threat categories, including prompt injection, data exfiltration, and remote code execution. No suspicious behaviors or security vulnerabilities were identified. The skill correctly manages credentials using environment variables and communicates with a local API endpoint for its intended music control functionality.
[INDIRECT_PROMPT_INJECTION]: The skill processes music metadata (artists, albums, tracks) from the Music Assistant API, which may originate from external providers. While this data is processed without explicit boundary markers, the skill's capabilities are strictly limited to music playback control, which minimizes the impact of potential injection attempts.
Ingestion points: Metadata results fetched via maCommand in handler.ts.
Boundary markers: Not explicitly implemented in the tool output strings.
Capability inventory: Limited to search and playback control (play, pause, volume, shuffle) on the Music Assistant instance.
Sanitization: Query strings are clipped to 80 characters in response messages.

music-assistant