The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill installs the "node-edge-tts" and "commander" packages from the NPM registry. The "scripts/package.json" file uses "npx" to execute a remote package command during testing, which involves a runtime download of the library from a public registry.
[COMMAND_EXECUTION]: Several scripts facilitate shell command execution for the skill's operation. "install.sh" runs "npm install", and "scripts/package.json" contains a test script that uses "npx". The documentation also instructs the user/agent to run Node.js scripts via the CLI.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted input text to generate audio output, creating a surface for indirect prompt injection.
Ingestion points: The "text" parameter in "scripts/tts-converter.js" and input to the built-in "tts" tool.
Boundary markers: The skill does not employ specific delimiters or system-level instructions to ignore malicious commands embedded within the input text.
Capability inventory: The skill has the ability to write files to the system's temporary directory (via "scripts/tts-converter.js") and perform network operations to communicate with the Microsoft Edge TTS service.
Sanitization: A rudimentary filter is applied in "scripts/tts-converter.js" to strip specific trigger keywords like "tts" from the input text, though this is intended for user experience rather than security.

edge-tts