The Agent Skills Directory

[SAFE]: The skill provides integration with the official Sonilo service for video-to-music generation. All referenced tools (mcp__sonilo__*), CLI commands (sonilo), and libraries (sonilo for Python and Node.js) are standard vendor-provided interfaces.
[EXTERNAL_DOWNLOADS]: The skill mentions official packages sonilo (Python/Node.js) and sonilo-cli. These are standard dependencies for using the vendor's API and are considered safe within the context of the service.
[COMMAND_EXECUTION]: The skill uses Bash to execute sonilo CLI commands. This is the intended functionality for the agent to interact with the installed service.
[DATA_EXPOSURE]: The skill references the SONILO_API_KEY environment variable. It correctly follows best practices by instructing the user to manage this secret via .env or the sonilo login flow rather than hardcoding credentials.
[INDIRECT_PROMPT_INJECTION]: The skill ingests user prompts and video files to generate music. While these are external inputs, the capabilities are limited to media generation via a controlled API, which does not present a path for privilege escalation or system-level compromise.

video-to-music