The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill downloads a ZIP archive containing executable Python scripts from an external CDN at https://cdn.beatra.ai/agent-packages/voiceover-narration-studio/v0.1.9/voiceover-narration-studio-skill-0.1.9.zip.
[REMOTE_CODE_EXECUTION]: The installation instructions direct the agent to download, extract, and immediately execute Python scripts (authorize.py and mcp_client.py). This pattern bypasses standard package management safety and executes external code on the host system.
[DYNAMIC_EXECUTION]: The skill includes a 'self-update' mechanism in mcp_client.py that is enabled by default. This feature allows the skill to fetch and replace its own executable files from a remote server without user approval for each update, providing a persistent vector for arbitrary code execution.
[DATA_EXFILTRATION]: The skill's primary function involves uploading user-supplied text scripts and media to external servers (mcp.beatra.ai) for hosted processing, which constitutes data transfer to a third party.
[CREDENTIALS_UNSAFE]: The authorize.py script performs an OAuth flow and stores a persistent bearer token in ~/.beatra/credentials.json. The skill documentation explicitly notes this token carries broad scope, including the ability to spend account credits (wallet:spend).
[INDIRECT_PROMPT_INJECTION]:
- Ingestion points: The skill processes untrusted user-supplied scripts intended for narration via the voiceover-narration-studio tool.
- Boundary markers: The provided markdown does not specify delimiters or safety instructions to prevent the agent from obeying commands embedded within the narration scripts.
- Capability inventory: The skill has access to shell execution (python3, curl), file system writing (~/.beatra/), and network communication (uploads to mcp.beatra.ai).
- Sanitization: No explicit sanitization or filtering of external script content is documented in the skill instructions.

voiceover-narration-studio